turkeyforfriends.com Open in urlscan Pro
193.109.246.214 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.authsmtp.interrealtytour.ru/
Effective URL:
https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Submission: On April 10 via automatic, source certstream-suspicious (April 10th 2021, 12:54:35 pm UTC)

Summary HTTP 261 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 37 IPs in 9 countries across 36 domains to perform 261 HTTP transactions. The main IP is 193.109.246.214, located in Moscow, Russian Federation and belongs to COMPUBYTE-AS, CY. The main domain is turkeyforfriends.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 11th 2020. Valid for: a year.

This is the only time turkeyforfriends.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	77.78.104.3 77.78.104.3	15685 (CASABLANC...) (CASABLANCA-AS Internet & Collocation Provider)
53	193.109.246.214 193.109.246.214	204343 (COMPUBYTE-AS) (COMPUBYTE-AS)
1	91.231.186.44 91.231.186.44	34221 (QL-AS) (QL-AS)
2 5	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	172.255.224.36 172.255.224.36	7979 (SERVERS-COM) (SERVERS-COM)
1	95.163.118.168 95.163.118.168	12695 (DINET-AS) (DINET-AS)
1 2	88.212.201.210 88.212.201.210	39134 (UNITEDNET) (UNITEDNET)
25	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	148.251.128.101 148.251.128.101	24940 (HETZNER-AS) (HETZNER-AS)
1	2606:4700:20:... 2606:4700:20::ac43:44ed	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
3 11	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
3	217.69.133.145 217.69.133.145	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
5	178.248.232.202 178.248.232.202	197068 (QRATOR) (QRATOR)
1	2a00:1450:400... 2a00:1450:400c:c0b::9a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
40	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2006	15169 (GOOGLE) (GOOGLE)
5	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
33	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
4 4	54.149.211.134 54.149.211.134	16509 (AMAZON-02) (AMAZON-02)
6 6	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
6 6	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
6 6	184.30.20.241 184.30.20.241	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	2a05:d01c:1d8... 2a05:d01c:1d8:8101:ac20:41f1:bf24:9b3	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4003:80c::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:68::9	15169 (GOOGLE) (GOOGLE)
2 2	34.246.227.69 34.246.227.69	16509 (AMAZON-02) (AMAZON-02)
4 4	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	79.137.69.120 79.137.69.120	16276 (OVH) (OVH)
1 1	18.194.113.221 18.194.113.221	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:aebc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	94.31.29.128 94.31.29.128	33438 (HIGHWINDS2) (HIGHWINDS2)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
1	185.106.81.236 185.106.81.236	7979 (SERVERS-COM) (SERVERS-COM)
1	13.69.68.15 13.69.68.15	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
261	37

1 77.78.104.3 (Czech Republic) 1 redirects

ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ)
PTR: yurika.gransy.com

www.authsmtp.interrealtytour.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

53 193.109.246.214 (Moscow, Russian Federation)

ASN204343 (COMPUBYTE-AS, CY)
PTR: dev.ucoz.net

turkeyforfriends.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.231.186.44 (Russian Federation)

ASN34221 (QL-AS, RU)

sys000.uweb.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.255.224.36 (Netherlands)

ASN7979 (SERVERS-COM, US)

c18.travelpayouts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.travelpayouts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.163.118.168 (Russian Federation)

ASN12695 (DINET-AS, RU)
PTR: ulogin.ru

ulogin.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.210 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host210.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.251.128.101 (Stuttgart, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: advcake.com

static.advcake.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:44ed (United States)

ASN13335 (CLOUDFLARENET, US)

st.avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 217.69.133.145 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: top-fwz1.mail.ru

top-fwz1.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 178.248.232.202 (Russian Federation)

ASN197068 (QRATOR, RU)

traff.travelata.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.149.211.134 (Boardman, United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-211-134.us-west-2.compute.amazonaws.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.227.252.103 (Kansas City, United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.64.189.115 (United Kingdom) 6 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 184.30.20.241 (Frankfurt am Main, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-241.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:d01c:1d8:8101:ac20:41f1:bf24:9b3 (London, United Kingdom) 2 redirects

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4003:80c::2003 (Ireland)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

redirector.gvt1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:68::9 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r4---sn-4g5edns7.gvt1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.246.227.69 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.139 (Frankfurt am Main, Germany) 4 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 79.137.69.120 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: gcm10.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.194.113.221 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-113-221.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:aebc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.bannerflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 94.31.29.128 (United Kingdom)

ASN33438 (HIGHWINDS2, US)
PTR: 94.31.29.128.IPYX-077437-ZYO.above.net

cmc-marke-cmc-markets.bannerflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.106.81.236 (Netherlands)

ASN7979 (SERVERS-COM, US)

avsplow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.69.68.15 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

560bd8d24d47fc28fc84259d.tracker.bannerflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	508 KB
55	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net	201 KB
53	turkeyforfriends.com turkeyforfriends.com	2 MB
18	gstatic.com www.gstatic.com fonts.gstatic.com csi.gstatic.com	375 KB
12	bannerflow.com cdn.bannerflow.com cmc-marke-cmc-markets.bannerflow.com 560bd8d24d47fc28fc84259d.tracker.bannerflow.com	68 KB
9	yandex.com 2 redirects mc.yandex.com	3 KB
8	googletagservices.com www.googletagservices.com	279 KB
8	google.com 2 redirects www.google.com adservice.google.com	1 KB
6	casalemedia.com 6 redirects ssum-sec.casalemedia.com	6 KB
6	pubmatic.com 6 redirects image6.pubmatic.com	4 KB
6	openx.net 6 redirects rtb.openx.net	1 KB
5	quantserve.com cms.quantserve.com	1 KB
5	googleapis.com fonts.googleapis.com	3 KB
5	travelata.ru traff.travelata.ru	44 KB
4	rubiconproject.com 4 redirects pixel.rubiconproject.com	2 KB
4	addthis.com 4 redirects e.dlx.addthis.com	4 KB
4	google.de adservice.google.de www.google.de	564 B
3	innovid.com 2 redirects ag.innovid.com	1 KB
3	2mdn.net s0.2mdn.net	45 KB
3	mail.ru top-fwz1.mail.ru	12 KB
2	everesttech.net 2 redirects pixel.everesttech.net	752 B
2	gvt1.com 1 redirects redirector.gvt1.com r4---sn-4g5edns7.gvt1.com	973 KB
2	rlcdn.com 2 redirects id.rlcdn.com	890 B
2	yandex.ru 1 redirects mc.yandex.ru	69 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	avsplow.com st.avsplow.com avsplow.com	14 KB
2	yadro.ru 1 redirects counter.yadro.ru	1 KB
2	travelpayouts.com c18.travelpayouts.com www.travelpayouts.com	8 KB
1	mookie1.com odr.mookie1.com	324 B
1	agkn.com 1 redirects d.agkn.com	663 B
1	gemius.pl 1 redirects googlecm.hit.gemius.pl	305 B
1	advcake.com static.advcake.com	59 KB
1	googleadservices.com partner.googleadservices.com	268 B
1	ulogin.ru ulogin.ru	19 KB
1	uweb.ru sys000.uweb.ru	1 KB
1	interrealtytour.ru 1 redirects www.authsmtp.interrealtytour.ru	278 B
261	36

	Domain	Requested by
53	turkeyforfriends.com	turkeyforfriends.com
40	tpc.googlesyndication.com	googleads.g.doubleclick.net turkeyforfriends.com tpc.googlesyndication.com pagead2.googlesyndication.com
33	cm.g.doubleclick.net	turkeyforfriends.com googleads.g.doubleclick.net
21	pagead2.googlesyndication.com	turkeyforfriends.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
20	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
10	cmc-marke-cmc-markets.bannerflow.com	cdn.bannerflow.com cmc-marke-cmc-markets.bannerflow.com
9	mc.yandex.com	2 redirects turkeyforfriends.com mc.yandex.ru
9	fonts.gstatic.com	fonts.googleapis.com
8	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
7	www.gstatic.com	www.google.com googleads.g.doubleclick.net
6	ssum-sec.casalemedia.com	6 redirects
6	image6.pubmatic.com	6 redirects
6	rtb.openx.net	6 redirects
5	cms.quantserve.com	googleads.g.doubleclick.net
5	fonts.googleapis.com	googleads.g.doubleclick.net
5	traff.travelata.ru	static.advcake.com turkeyforfriends.com
5	www.google.com	2 redirects turkeyforfriends.com googleads.g.doubleclick.net
4	pixel.rubiconproject.com	4 redirects
4	e.dlx.addthis.com	4 redirects
3	ag.innovid.com	2 redirects googleads.g.doubleclick.net
3	s0.2mdn.net	turkeyforfriends.com googleads.g.doubleclick.net s0.2mdn.net
3	top-fwz1.mail.ru	turkeyforfriends.com top-fwz1.mail.ru
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
2	pixel.everesttech.net	2 redirects
2	csi.gstatic.com	www.gstatic.com
2	id.rlcdn.com	2 redirects
2	mc.yandex.ru	1 redirects turkeyforfriends.com
2	www.google-analytics.com	turkeyforfriends.com www.google-analytics.com
2	counter.yadro.ru	1 redirects turkeyforfriends.com
1	ade.googlesyndication.com
1	560bd8d24d47fc28fc84259d.tracker.bannerflow.com	cmc-marke-cmc-markets.bannerflow.com
1	www.travelpayouts.com	turkeyforfriends.com
1	avsplow.com	st.avsplow.com
1	odr.mookie1.com	googleads.g.doubleclick.net
1	cdn.bannerflow.com	s0.2mdn.net
1	d.agkn.com	1 redirects
1	googlecm.hit.gemius.pl	1 redirects
1	r4---sn-4g5edns7.gvt1.com	googleads.g.doubleclick.net
1	redirector.gvt1.com	1 redirects
1	googleads4.g.doubleclick.net	turkeyforfriends.com
1	www.google.de	turkeyforfriends.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	st.avsplow.com	c18.travelpayouts.com
1	static.advcake.com	c18.travelpayouts.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	ulogin.ru	turkeyforfriends.com
1	c18.travelpayouts.com	turkeyforfriends.com
1	sys000.uweb.ru	turkeyforfriends.com
1	www.authsmtp.interrealtytour.ru	1 redirects
261	50

This site contains links to these domains. Also see Links.

Domain
avia.turkeyforfriends.com
www.travelpayouts.com
play.google.com
vk.com
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
turkeyforfriends.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-11` - `2021-05-11`	a year	crt.sh
*.uweb.ru GoGetSSL RSA DV CA	`2020-09-16` - `2021-09-16`	a year	crt.sh
www.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.travelpayouts.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-02` - `2022-02-07`	2 years	crt.sh
ulogin.ru R3	`2021-03-09` - `2021-06-07`	3 months	crt.sh
counter.yadro.ru R3	`2021-03-22` - `2021-06-20`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.advcake.com R3	`2021-03-01` - `2021-05-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-16` - `2021-07-16`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-02-27` - `2021-08-09`	5 months	crt.sh
*.mail.ru GeoTrust ECC CA 2018	`2020-11-13` - `2021-11-17`	a year	crt.sh
*.travelata.ru Sectigo RSA Domain Validation Secure Server CA	`2020-09-07` - `2021-09-10`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.c.docs.google.com GTS CA 1O1	`2021-03-30` - `2021-06-08`	2 months	crt.sh
*.bannerflow.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-10` - `2022-03-13`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
avsplow.com R3	`2021-02-09` - `2021-05-10`	3 months	crt.sh
*.tracker.bannerflow.com R3	`2021-03-30` - `2021-06-28`	3 months	crt.sh

This page contains 29 frames:

Primary Page: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Frame ID: C7A5B92CC4841DD79BE426CD8EEB15F5
Requests: 98 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210406/r20190131/zrt_lookup.html
Frame ID: 37B272A4FCAB15D97BF24C6B7892EA14
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=3125688885&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255446&bpp=45&bdt=622&idt=96&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3359245479880&frm=20&pv=2&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=858&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=VEwKMOYzKw&p=https%3A//turkeyforfriends.com&dtd=118
Frame ID: 9536861450BC7A5F29B2B7F88ACE1C88
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89
Frame ID: A9647A2F423D439ABC6B96CC5F775883
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&adk=1812271804&adf=3025194257&lmt=1618058393&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&ea=0&flash=0&pra=5&wgl=1&dt=1618059255783&bpp=1&bdt=960&idt=1&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200&nras=1&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&dtd=7
Frame ID: CE8BAABFD0265F41104142D023195F20
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15
Frame ID: 52CBD6D0593F0069BE392B1FE0680C48
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20
Frame ID: C599AE5A0B5DBDF2E857A89B3AD41FCE
Requests: 22 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24
Frame ID: 34285944C08CABA02F691D916C22B368
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=1732375815&pi=t.aa~a.3910346740~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100&nras=5&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2245&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=vP2JuyzZpO&p=https%3A//turkeyforfriends.com&dtd=28
Frame ID: 72C1673BC171EC44DEE4C4E4F186C0A4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33
Frame ID: 80A757E0F3BEA2952443BB0AA16B48A4
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: 97CA58A60D4216F587F4EEA3DFE862B5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: DB721A7CDBDA362E03D6BDCAC60F96A9
Requests: 1 HTTP requests in this frame

Frame: https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuOgOOJYSMDvBWlBTkHcCRpYh-xOpxVf-a-IpPjm_BkdEVMxpYbauZPVKgfC4YUdMFnNyugkZrlDt0Z7Pbdfnuq8cbAMxf5GWj15GSML56Hb-W1Eti5UQ9w0IN8Udcb-1Ri2ml7wabfDCv3NTHjxxjgX9sZUFVs7VL4DGoV0CJ3L3r4VkUqwLjKI-IiF9UxRgdyn5Etl8JoJs_KNDz7Fr-kx25jzhTTiwEUaNCXrKZvz6AYumtj2VeNOMphivc23GOtyASLd9BZ0fkCPKiUWf0kR6h2d5R7nTvMuO5HWpHr4LDo99k6scr6Vupkq0LkOL1SXe-nnm4J3XaLlX14Qsa5hpcjjiUkmpJcixj4KNnl-mvSaJgcpiNuVtUW6MaWImizN3R9l27L_Yl_ko2Xu7dWrPU_mUEVzynidhLOkIP2f1kzjveDMCBIhv5hgD70rrnyzvu2qKKFN68ZAPoVfI3emPtZgm0q8nlx6m2MeEWdvb05qtFOR9iHC2dOkXc2b7jHUZ5zhMh8APmrp3cuQzkubS13F2OJZnBp3RQJTcpIAUUoZ6B0lBLwpP2_VsoBpaEkx46Lr3Q7PEqJ7Z7yHJA4rHOTDNUPi1BOU_FWLB2QxrkD3gSoQRaVAkI4dlJgSaTMlTL-gKtrpcXPj9Foz-b80EtTbwa_qL-k8FwKcED86NhSLE4ASIG1l1oVRssoI338g985HSuVYWnODrLx9ga__6hFV18MovcUIpqGbxZFRXZfvPc7Jg3VLmBO02PG6GZKqtIY9k1UGeW6_i3ttzzJK2N6eyprkGebLT_MEmIVqA5SgLAewhBMv2YTPqLjKJr1lyIpzzYEjljWFsx4fAW2WkHApGB_AjmRp34oaQA5n6nvvad0eMMRc-3AxWgXq_O94sp90teCAsfVqpowjyVrmpTBg9VE242j8WYwviL6M4kfQphg0al3ZxVq4rVCUaDW_hJIpqb2cAJoTLcNuKN5xqWAPc0DHO-GROymA2T9tZFEVIQ0YBdRGsi2S1t_ts9pUIZGEjGeoFaUap_hHRkL3p-URaQr_aUl-7RaMFwStSev6OMVxKsIiculuhE4nFR_5ORiqVaNTkV0F2un_GIoz5Zvmym4V2FjUertiwXmtxPFFRBGJ_A&sig=Cg0ArKJSzN5LDoM1AESdEAE&urlfix=1&adurl=&tpd=AGWhJmsa0ZiST4TbcwpV2gPN-xY3j6SsQBaJCa9WnN3L5_-I3w
Frame ID: 3A4A5411420A1D36F784F8850ED5C24A
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 005C7ED3A8B2CC7B9FDA5DD0F83FDCD2
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B9F3CA1A3D3769EDB71631C4F85F590E
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/6418128/1606738030413/DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.html
Frame ID: 0624C05E9F86FFE14D31FF505C1440B7
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 117D6F5526925399B966B27871844E6D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6F4EDC496BBFEB865CF39C63284AC311
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E4B101824F73C17EB0B0545EA5B45578
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: CEE1C676F6524459C1458619DF93CBE9
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 16C60DFD9987C7982C7991F349644FB2
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: A0212CF1C5FBC261813AFA24320E99C3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 19CBDF406F7961C004BEC4C99A309280
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: 7451A63A7F8F95E0B04E8AD3F52B42B5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: 22F568B0982DC8BA8B5D29D17F87B260
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js
Frame ID: 261AB9B01B676F4EB3AC5A793B5B01F5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 74491E3299F45CB629919DF1408C8B05
Requests: 2 HTTP requests in this frame

Frame: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html?cb=637528818793513813&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Frame ID: 494A80552FF79FC639A6EDD012EB19E9
Requests: 2 HTTP requests in this frame

Frame: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Frame ID: 55AE4E10B22F9FF31C1D1464CE4D726F
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.authsmtp.interrealtytour.ru/ HTTP 302
https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

261
Requests

100 %
HTTPS

45 %
IPv6

36
Domains

50
Subdomains

37
IPs

9
Countries

4398 kB
Transfer

7159 kB
Size

16
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://avia.turkeyforfriends.com/
Title: Авиабилеты

Search URL Search Domain Scan URL

URL: https://www.travelpayouts.com/?marker=14494.poweredby&utm_source=powered_by&utm_medium=network&utm_campaign=18&utm_keyword=promo_1491

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=ru.codenight.ontu
Title:

Search URL Search Domain Scan URL

URL: https://vk.com/turkeyforfriends

Search URL Search Domain Scan URL

URL: https://www.facebook.com/turkeyforfriends/

Search URL Search Domain Scan URL

URL: https://twitter.com/turkeyforfriend/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/turkeyforfriends/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJc_xMROFXTCNXaCSy-G4TQ/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.authsmtp.interrealtytour.ru/ HTTP 302
https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://counter.yadro.ru/hit;noadsuweb?r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369 HTTP 302
https://counter.yadro.ru/hit;noadsuweb?q;r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369

Request Chain 102

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9239.W7bzqTDCjUlbTp8a9Cqb1XOFFzQNqI0ZJXEgeqm_gmWsjeU5DE1bssPVxv2Gy38y.UY8sEIDKl8BEcUCjKXZcOrwR5zc%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9239.iEHxZ8W_moYfsudiJMhb3HER67dYCjnZmrn635kpiaR-JHygmQJTxM7ESQqZOL6DUJITmRqWovWkaWaMqaEaKQ%2C%2C.4fuQlKEIROtTIAzDNnjYedGV2Vk%2C

Request Chain 119

https://mc.yandex.com/watch/4502077?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afp%3A1475%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A983972087457%3Ahid%3A1017741564%3Az%3A120%3Ai%3A202104010145416%3Aet%3A1618059256%3Ac%3A1%3Arn%3A483372173%3Au%3A1618059256274837472%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618059253938%3Ads%3A66%2C194%2C340%2C1%2C283%2C0%2C%2C970%2C1%2C%2C%2C%2C1856%3Adsn%3A65%2C194%2C340%2C1%2C283%2C0%2C%2C972%2C1%2C%2C%2C%2C1856%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618059256%3At%3A%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9 HTTP 302
https://mc.yandex.com/watch/4502077/1?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afp%3A1475%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A983972087457%3Ahid%3A1017741564%3Az%3A120%3Ai%3A202104010145416%3Aet%3A1618059256%3Ac%3A1%3Arn%3A483372173%3Au%3A1618059256274837472%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618059253938%3Ads%3A66%2C194%2C340%2C1%2C283%2C0%2C%2C970%2C1%2C%2C%2C%2C1856%3Adsn%3A65%2C194%2C340%2C1%2C283%2C0%2C%2C972%2C1%2C%2C%2C%2C1856%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618059256%3At%3A%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9

Request Chain 138

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitUKKL_UMccKEiHHXJY2CbIhSlDLxlLgUa1A2nizRBTMaKfhn22Hb53EgonX7lNGJZhVOdTVmzaSkeI0DtkyILXOEujtwGKrt_g&google_gid=CAESELk0gv-bzoQuMxY0NZcJTas&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPi_xoMGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BUXZpdFVLS0xfVU1jY0tFaUhIWEpZMkNiSWhTbERMeGxMZ1VhMUEybml6UkJUTWFLZmhuMjJIYjUzRWdvblg3bE5HSlpoVk9kVFZtemFTa2VJMER0a3lJTFhPRXVqdHdHS3J0X2c HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRG9fY24wRFYzbnpibi04WFh2TnpZREpVOW9OS21NSmxfVHJWRHgyaUs0Yw==&google_push

Request Chain 139

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00VSkrnM_5hZ8rhu9_Fpaii_ivvRUVnfUeA&google_gid=CAESENwOCujWZ7AAw2Lpt4oLd3A&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00VSkrnM_5hZ8rhu9_Fpaii_ivvRUVnfUeA&google_gid=CAESENwOCujWZ7AAw2Lpt4oLd3A&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc4MDgzMDYyNDIwMTU5Ng%3D%3D&google_push=AQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00VSkrnM_5hZ8rhu9_Fpaii_ivvRUVnfUeA

Request Chain 140

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Request Chain 141

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitUJpEH9lR-CRFLofJvw_k_V_qlZZDyoAbkwdwLDXWFl6Ue8eK9_OH0W5xw0GTKSbeSX_vtyUdhvnpD6OKTnyrx6DrtujqkS2Pw HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitUJpEH9lR-CRFLofJvw_k_V_qlZZDyoAbkwdwLDXWFl6Ue8eK9_OH0W5xw0GTKSbeSX_vtyUdhvnpD6OKTnyrx6DrtujqkS2Pw&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJpEH9lR-CRFLofJvw_k_V_qlZZDyoAbkwdwLDXWFl6Ue8eK9_OH0W5xw0GTKSbeSX_vtyUdhvnpD6OKTnyrx6DrtujqkS2Pw

Request Chain 142

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeXBzFyS7nMqDlr-CQQDATs_mHuIgBvOtLQtG6NzAD6U15Vl7mRPiwSI-5-W_Ann4ARg HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeXBzFyS7nMqDlr-CQQDATs_mHuIgBvOtLQtG6NzAD6U15Vl7mRPiwSI-5-W_Ann4ARg&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeXBzFyS7nMqDlr-CQQDATs_mHuIgBvOtLQtG6NzAD6U15Vl7mRPiwSI-5-W_Ann4ARg

Request Chain 184

https://redirector.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=ip,ipbits,expire,id,itag,source,requiressl&signature=9B864DCD393284B0CF33B3CC762F50077729AF91.18B94979DE0F13720C15B6A724EB8A38AD13F6C4&key=ck2 HTTP 302
https://r4---sn-4g5edns7.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=7FEB316F8BEB598D271F44EE90A2957B0287C7D0.5859D952329BE70283751124F6C055086F22F532&key=cms1&cms_redirect=yes&mh=-L&mip=2a01:4f8:192:5414::2&mm=28&mn=sn-4g5edns7&ms=nvh&mt=1618058699&mv=u&mvi=4&pl=49

Request Chain 197

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcNqa0LVAvz7EAt19DKBHH9wGnVB8vEV-gKKu1O7ckCqbjM9lNoQ1Np_n5aL&google_gid=CAESEFxLboTMsn8yEvQqwDxopt0&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFCSzh2a2tiTQ&google_push=AQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcNqa0LVAvz7EAt19DKBHH9wGnVB8vEV-gKKu1O7ckCqbjM9lNoQ1Np_n5aL

Request Chain 198

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Request Chain 199

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitUJ-PSHfWxpO2lWwKlqquH_vdz4RmdsxEUH9hihW3xr6I-xO7it4XUnFTmArBm8lso1r2bTrEtvMjoX21j-_BvE3vMpCUBI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ-PSHfWxpO2lWwKlqquH_vdz4RmdsxEUH9hihW3xr6I-xO7it4XUnFTmArBm8lso1r2bTrEtvMjoX21j-_BvE3vMpCUBI

Request Chain 200

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058argL4VPa4XLfJtkjg1kRXRY4R HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBEQ1AtQS1NQ1lW&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058argL4VPa4XLfJtkjg1kRXRY4R

Request Chain 201

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULzagLjgJwMNcEJQXX5k4auD4W6KvS6NiXu7ZABpLfhJS-8hurCC4mZ5osjQQvEdhounc6c-ZGlCHRg_Hfs9x3v6ivXy-E HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULzagLjgJwMNcEJQXX5k4auD4W6KvS6NiXu7ZABpLfhJS-8hurCC4mZ5osjQQvEdhounc6c-ZGlCHRg_Hfs9x3v6ivXy-E

Request Chain 202

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPRx3oZTpq3VwzPQ71V9c9E&google_cver=1&google_push=AQvitUITZ_ztmibvhLwjTqLUTSRCTCtFxsArJAHpQ1gMt4tQbcobZ7P5gSiGLpzOKgEu0dWRGhUCVfkItcz0LjFKzcvLQZyyvRme HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUITZ_ztmibvhLwjTqLUTSRCTCtFxsArJAHpQ1gMt4tQbcobZ7P5gSiGLpzOKgEu0dWRGhUCVfkItcz0LjFKzcvLQZyyvRme&google_hm=

Request Chain 208

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 210

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6jnbWomVngkt5dUDPEo69wrwLoCBlcvwZXrJ6uunJTnt6zq4V_XvXLs3I-o&google_gid=CAESEFxLboTMsn8yEvQqwDxopt0&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFBUU9lSFg3QA&google_push=AQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6jnbWomVngkt5dUDPEo69wrwLoCBlcvwZXrJ6uunJTnt6zq4V_XvXLs3I-o

Request Chain 211

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Request Chain 212

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitUJ1Xe2d3l09Ki876RqD7BFpj-_nPwlX7wh0Jn2881Qi1fSXSb_sr9FwVt1CujSkX56NzbOzahAKfXS5ukQts63O3tL-IBTl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ1Xe2d3l09Ki876RqD7BFpj-_nPwlX7wh0Jn2881Qi1fSXSb_sr9FwVt1CujSkX56NzbOzahAKfXS5ukQts63O3tL-IBTl

Request Chain 213

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8hr_Yu8aY4XEVYpSd2FKk2JFlw4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERFQtMy0yV0ZE&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8hr_Yu8aY4XEVYpSd2FKk2JFlw4

Request Chain 214

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULMtHhInsXFL4NWlwBYHyghmUTN4lNoNUEsJFxHJ0Tadh0soGxK_yAST_2BwitWMmR6kabC-nd8Gzwo2lUmwZPHrDgQnkgM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULMtHhInsXFL4NWlwBYHyghmUTN4lNoNUEsJFxHJ0Tadh0soGxK_yAST_2BwitWMmR6kabC-nd8Gzwo2lUmwZPHrDgQnkgM

Request Chain 215

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEFxLJeSENIDUsnbE5XuUpbM&google_cver=1&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1SgjR00 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1SgjR00&google_hm=ChGgynZCSzecpxQEfNkdZg

Request Chain 219

https://d.agkn.com/pixel/2175/?google_gid=CAESEF-AvcAFCsrbM-FLNeR12QI&google_cver=1&google_push=AQvitULISuk6rnCQN1xzOoPFZl-MLzYV-_TbIQSIEX_kjC92DSrOVedoF5WqPoZctxnYSOy-6c8Hu6tzHBN78rNxuMnkWM3zPtA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=akneustar_dmp&google_cm&google_hm=Q0FFU0VGLUF2Y0FGQ3NyYk0tRkxOZVIxMlFJ

Request Chain 220

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6MAkC5Bf2tncUKleKpMJ9DAFZbEJC-A&google_gid=CAESENwOCujWZ7AAw2Lpt4oLd3A&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6MAkC5Bf2tncUKleKpMJ9DAFZbEJC-A&google_gid=CAESENwOCujWZ7AAw2Lpt4oLd3A&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc5MjM3MTQ0NzY2MTY1MQ%3D%3D&google_push=AQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6MAkC5Bf2tncUKleKpMJ9DAFZbEJC-A

Request Chain 221

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Request Chain 222

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitULU3R4aDzNIxhDC8DfjDzxINqED5CnEcEpEzO6qs9PKanBct3dWf8D8fOoagKAu15Ta0dlhp_iFB7uaFjllmxHzIJPF-Hc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULU3R4aDzNIxhDC8DfjDzxINqED5CnEcEpEzO6qs9PKanBct3dWf8D8fOoagKAu15Ta0dlhp_iFB7uaFjllmxHzIJPF-Hc

Request Chain 223

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEYef8KZ5hbKw2fWNv1rUMWt7yk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERTgtMjItMkJPUw==&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEYef8KZ5hbKw2fWNv1rUMWt7yk

Request Chain 224

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJmqSD65H9P4XtO6PfGUzJD-VsxMJND6WVYim7WJ0qSn8fj-AwoL_FvtIdeCt_RVMmRZNvSzQfe1i1cxX7Rhn1B0WUF3w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_push=AQvitUJmqSD65H9P4XtO6PfGUzJD-VsxMJND6WVYim7WJ0qSn8fj-AwoL_FvtIdeCt_RVMmRZNvSzQfe1i1cxX7Rhn1B0WUF3w&google_cver=1&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY

Request Chain 228

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 237

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Request Chain 238

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC2OioH4t2sCZ9Ww3A-d2Gc&google_cver=1&google_push=AQvitUKiW_I4C-KKVhqTKqDmoNFTLCdsDGC_K5gciLV84tZSPPtdhSaXnDXTzyt4nqW8iHi4bbw615O2PzRetIy4Y7gnB7yf3gNU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUKiW_I4C-KKVhqTKqDmoNFTLCdsDGC_K5gciLV84tZSPPtdhSaXnDXTzyt4nqW8iHi4bbw615O2PzRetIy4Y7gnB7yf3gNU

Request Chain 239

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-KpCrti3HFnSJHFDCblqR23MQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBESjAtMy1FSDJY&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-KpCrti3HFnSJHFDCblqR23MQ

Request Chain 240

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUIJvdInWEsG5M7tia-950gEiKpSTsiL_DROO_dX0VkxsnJm3zJEYVt9BHhzXHm3WcbwC7BqEmTdEnbPKoMwF9eBYooLijzx HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUIJvdInWEsG5M7tia-950gEiKpSTsiL_DROO_dX0VkxsnJm3zJEYVt9BHhzXHm3WcbwC7BqEmTdEnbPKoMwF9eBYooLijzx

Request Chain 241

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEFxLJeSENIDUsnbE5XuUpbM&google_cver=1&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-lyUo4k HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-lyUo4k&google_hm=ChGgynZCSzecpxQEfNkdZg

261 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set 21-1-0-6789 Show response
turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/
Redirect Chain

https://www.authsmtp.interrealtytour.ru/
https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

59 KB
17 KB

600ms
340ms

Document
text/html

193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: ad7f82b6dfb74faddf961922b744ae095db97ea589cbe4a02c18129474428fff

Request headers

Host: turkeyforfriends.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: nginx
Date: Sat, 10 Apr 2021 12:54:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Set-Cookie: 0trforfriendsuCoz=; path=/; expires=Thu, 11-Apr-2019 12:54:16 GMT; domain=.turkeyforfriends.com 0trforfriendspu=hRr4n3Fg; path=/; expires=Sun, 10-Apr-2022 12:54:16 GMT; domain=.turkeyforfriends.com 0trforfriendsuzll=1618059256; path=/; expires=Sun, 10-Apr-2022 12:54:16 GMT; domain=.turkeyforfriends.com
Cache-Control: no-cache,no-store private
Pragma: no-cache
Vary: host
Last-Modified: Sat, 10 Apr 2021 12:39:53 GMT
Content-Encoding: gzip

Redirect headers

Server: openresty/1.19.3.1
Date: Sat, 10 Apr 2021 12:54:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

GET
H/1.1 200
OK new.css
turkeyforfriends.com/ 112 KB
22 KB 114ms
112ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/new.css?4
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 6355f505a989a8737edcf9db74dff129c4b6ec44d99cf27aaee9cba4a56d458b

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:15 GMT
Content-Encoding: gzip
Last-Modified: Sat, 13 Mar 2021 05:53:01 GMT
Server: nginx
ETag: W/"604c533d-1c18a"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:15 GMT

GET
H/1.1 200
OK fa.css
turkeyforfriends.com/css/ 25 KB
5 KB 275ms
96ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/css/fa.css
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 290f722475e26cf4eb3d2df8d8ece7304eeffb71660bd6ddb1d0c4a996c06b55

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Sat, 29 Apr 2017 11:57:48 GMT
Server: nginx
ETag: W/"59047fbc-6262"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK base.min.css
turkeyforfriends.com/.s/src/ 22 KB
6 KB 278ms
89ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/base.min.css
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 284ed3ce26c7a40eb6048708302382442a63c821b8fd407e6009c48fb3fccdcf

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Tue, 30 Mar 2021 12:56:13 GMT
Server: nginx
ETag: W/"60631fed-56cc"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK layer5.min.css
turkeyforfriends.com/.s/src/ 18 KB
4 KB 278ms
89ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/layer5.min.css
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 6cd9a718f957858ebb3d9e68cb027ab035343ce49f1294ad570fa2ab33d30208

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jul 2020 12:29:11 GMT
Server: nginx
ETag: W/"5f070d97-4868"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
turkeyforfriends.com/.s/src/ 85 KB
30 KB 386ms
179ms Script
text/javascript 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/jquery-3.3.1.min.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Feb 2018 13:16:03 GMT
Server: nginx
ETag: W/"5a8ace13-1538f"
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK uwnd.min.js Show response
turkeyforfriends.com/.s/src/ 205 KB
56 KB 385ms
110ms Script
text/javascript 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/uwnd.min.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 2c52e0a3468b3e72e9ec63a78394bfa483d81bbb2eaea9e54c58374735eea726

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Tue, 23 Mar 2021 13:56:31 GMT
Server: nginx
ETag: W/"6059f38f-33552"
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK socCom.css
turkeyforfriends.com/.s/src/ 6 KB
2 KB 288ms
92ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/socCom.css
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: bc9c46970b8459d26f30942a7b4a0a388e6d25b3501d0eadf0052c4015bcf360

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Oct 2017 12:47:58 GMT
Server: nginx
ETag: W/"59dcc17e-19f9"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK bottomInfo.min.js Show response
turkeyforfriends.com/.s/src/ 4 KB
2 KB 369ms
91ms Script
text/javascript 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/bottomInfo.min.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 46348c08676290dcf101dc39ef729028003bfc8706f1c8af0fee030360513292

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Tue, 13 Oct 2020 09:17:51 GMT
Server: nginx
ETag: W/"5f8570bf-e64"
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK socCom.js Show response
turkeyforfriends.com/.s/src/ 6 KB
2 KB 370ms
92ms Script
text/javascript 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/socCom.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 96ae2c4dd85b85004b0f54694c5d91eb909e92114f18d46273e0e6995be86444

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 20 Apr 2017 08:03:31 GMT
Server: nginx
ETag: W/"58f86b53-18c8"
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK uutils.fcg Show response
sys000.uweb.ru/cgi/ 513 B
1 KB 454ms
97ms Script
application/javascript 91.231.186.44
QL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sys000.uweb.ru/cgi/uutils.fcg?a=soc_comment_get_data&site=0trforfriends
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.231.186.44 , Russian Federation, ASN34221 (QL-AS, RU),
Reverse DNS
Software: nginx/1.8.0 /
Resource Hash: 4219a39b6ff7a0b6606a0af20c38476a350b35c0b44aa5c4d1b77724ad3ef904

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:13 GMT
Server: nginx/1.8.0
Vary: host
P3P: CP="CAO PSA OUR"
Cache-Control: no-cache,no-store
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: application/javascript; charset=UTF-8
Keep-Alive: timeout=15

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 905 B
671 B 52ms
52ms Script
text/javascript 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=reCallback&render=explicit&hl=ru

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f190cb36d00f160e9280b48c1171f545af0497b47208c8e5afe5e677ae92bf4c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 579
x-xss-protection: 1; mode=block
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H/1.1 200
OK social.css
turkeyforfriends.com/.s/src/ 2 KB
929 B 288ms
92ms Stylesheet
text/css 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/.s/src/social.css
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: df9ba466bcb8c9eee28c0ea55699ef4e7c15064bb7e1c0d5f0d5a3d2ea8bd7f4

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 20 Apr 2017 08:03:31 GMT
Server: nginx
ETag: W/"58f86b53-8f6"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK jquery.scrollbar.min.js Show response
turkeyforfriends.com/js/ 12 KB
4 KB 384ms
97ms Script
text/javascript 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://turkeyforfriends.com/js/jquery.scrollbar.min.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 4854d668e624136dd7933baeeca9b0df8e97769dd2e3670575b19add70cfcbdf

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Sat, 17 Aug 2019 15:57:58 GMT
Server: nginx
ETag: W/"5d582406-2e67"
Transfer-Encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=1728000
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK logo.png
turkeyforfriends.com/imgtur/ 74 KB
74 KB 103ms
98ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/imgtur/logo.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 1e7fb809061fcc36e119907fbc2d6a074f1490ba05f2dac809ee63e613763aba

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Fri, 22 Nov 2013 02:00:15 GMT
Server: nginx
ETag: "528ebaaf-127a4"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 75684
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK 45789519.jpg
turkeyforfriends.com/_pu/67/ 109 KB
110 KB 110ms
106ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/67/45789519.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: b46a9598ebcb8990e15425d7448d07588b574e313c7ff9430817141cefa5f887

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Sun, 15 Mar 2020 16:24:22 GMT
Server: nginx
ETag: "5e6e56b6-1b559"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 111961
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 135 KB
47 KB 27ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b35f828bed609bd50d0004f302ae90810fcfdff55f4a1a50f7d801f590f2358

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48426
x-xss-protection: 0
server: cafe
etag: 9073347465432709909
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H/1.1 200
OK noavatar.png
turkeyforfriends.com/.s/img/icon/social/ 572 B
899 B 95ms
91ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/icon/social/noavatar.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 6f005ef7cd0da757fba872c5832f3c2a52b928808764ff1e9823c53069b7538a

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Mon, 20 Feb 2017 09:40:47 GMT
Server: nginx
ETag: "58aab99f-23c"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 572
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK i3.gif
turkeyforfriends.com/.s/img/ma/m/ 9 KB
9 KB 94ms
90ms Image
image/gif 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/ma/m/i3.gif
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 9cf0f584767e187fce250df4a1aeaa01c0a89fa1dd4090c48bc064a8f05fdd1e

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Mon, 20 Feb 2017 09:40:47 GMT
Server: nginx
ETag: "58aab99f-2450"
Content-Type: image/gif
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 9296
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s71201189.jpg
turkeyforfriends.com/_pu/65/ 14 KB
15 KB 153ms
149ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/65/s71201189.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 60120fdf580c67cffb3205987c4a22c928514ca185a3e3d6923be2f3cc934b68

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 30 Oct 2018 12:12:29 GMT
Server: nginx
ETag: "5bd84aad-392d"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 14637
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s38581963.jpg
turkeyforfriends.com/_pu/52/ 16 KB
16 KB 162ms
158ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/52/s38581963.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 33f79fd69ddb209232f3f1d431f46527406796680fd0b9b747ce227d2ad5c97c

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Sun, 20 Dec 2015 07:34:14 GMT
Server: nginx
ETag: "567659f6-3e1b"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 15899
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s87823673.jpg
turkeyforfriends.com/_pu/32/ 5 KB
5 KB 208ms
208ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/32/s87823673.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 22766bc9711d38912c8907394f87278de19fd42c4ac625b8883306bb93cd08bd

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Sun, 04 May 2014 08:29:16 GMT
Server: nginx
ETag: "5365fa5c-12d8"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4824
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s46125271.jpg
turkeyforfriends.com/_pu/31/ 7 KB
8 KB 243ms
243ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/31/s46125271.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: c3a3c88ea0b781bd1ab252d80ed7324f7f124d4fa790dfc459db47abecd2bfa1

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 18 Mar 2014 13:41:25 GMT
Server: nginx
ETag: "53284d05-1d34"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 7476
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s48457708.jpg
turkeyforfriends.com/_pu/25/ 6 KB
6 KB 135ms
134ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/25/s48457708.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 72b73c5ea4d054331853ea22776ecc5e7c65eecb24ca290f659037fd525f46d0

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Fri, 22 Nov 2013 02:00:15 GMT
Server: nginx
ETag: "528ebaaf-17ab"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 6059
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK 04701493.jpg
turkeyforfriends.com/_pu/66/ 14 KB
14 KB 159ms
159ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/66/04701493.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 7f35322549c2066c51df696a0f251672e04828dcee72af97667e24bc293c3a98

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Thu, 23 May 2019 09:38:02 GMT
Server: nginx
ETag: "5ce669fa-3862"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 14434
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s55487177.jpg
turkeyforfriends.com/_pu/65/ 15 KB
16 KB 100ms
100ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/65/s55487177.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 2952b9e57d2b46de9b4948d041b70e372084591f4760914788299e8509b27b9f

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 15 Jan 2019 11:47:11 GMT
Server: nginx
ETag: "5c3dc83f-3d96"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 15766
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s68513869.jpg
turkeyforfriends.com/_pu/65/ 13 KB
13 KB 103ms
103ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/65/s68513869.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 698a9a9ec926a15d254a8a7fa0c9523aa8e2884b349f3a061e2fcab3d9e27799

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Mon, 21 Jan 2019 13:17:06 GMT
Server: nginx
ETag: "5c45c652-341a"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 13338
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s21263201.jpg
turkeyforfriends.com/_pu/64/ 15 KB
16 KB 153ms
153ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/64/s21263201.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: c3736a522ece00aeacddf66c21e54fc1b604b312922e2131d9e3f3e5532e7c30

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Wed, 12 Sep 2018 06:17:14 GMT
Server: nginx
ETag: "5b98af6a-3d9f"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 15775
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK s23152658.jpg
turkeyforfriends.com/_pu/63/ 16 KB
16 KB 101ms
100ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_pu/63/s23152658.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 7360ab3a1e1fd97cdd1c6cb71e7ef02ee20cdcbad9a15875e3a8fe77def4e415

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Sat, 27 Jan 2018 12:29:34 GMT
Server: nginx
ETag: "5a6c70ae-4000"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 16384
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H2 200 content Show response
c18.travelpayouts.com/ 14 KB
5 KB 157ms
50ms Script
application/javascript 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://c18.travelpayouts.com/content?promo_id=1491&shmarker=14494&country=92&horizontal=false&animated=true&trs=21646&powered_by=false
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2e783289cd2640b5cabdf71585e779325e293d11e420d1a5a70096b358fdc38d

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
server: nginx
etag: W/"ad611cca5a06b3f76eb352dbb7181b1411eaeaa5"
content-type: application/javascript
cache-control: private, max-age=0
x-promo-id: 1491
x-request-id: a7922f9df38fee549b338a0b9b8eccb7

GET
H/1.1 200
OK 320kh480.gif
turkeyforfriends.com/bannery/ 81 KB
82 KB 386ms
284ms Image
image/gif 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/bannery/320kh480.gif
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 1c4f7c67d603a19e087a6a0ac87a53e6ba408407b0e9931936dd063eaf60406f

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Sun, 15 Dec 2019 12:46:59 GMT
Server: nginx
ETag: "5df62b43-145a5"
Content-Type: image/gif
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 83365
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK 04210795.jpg
turkeyforfriends.com/_nw/26/ 344 KB
344 KB 381ms
295ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_nw/26/04210795.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 2e5157e22a908c379b53f6eb11cc56fcdfc408533728b3e7ecc0144ec636313c

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Fri, 09 Apr 2021 06:38:21 GMT
Server: nginx
ETag: "606ff65d-55fe0"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 352224
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK 50714943.jpg
turkeyforfriends.com/_nw/26/ 209 KB
210 KB 106ms
104ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_nw/26/50714943.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 7b77bf52a193d42bdead2b71247e73e30577dc552b0bbbf732791388481d5472

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Fri, 09 Apr 2021 05:49:41 GMT
Server: nginx
ETag: "606feaf5-3454a"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 214346
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK 71144265.jpg
turkeyforfriends.com/_nw/26/ 103 KB
103 KB 107ms
106ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_nw/26/71144265.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: e674d825869b8d439df76b3a71d076999cf477dda5a54486af0a1f01879dcc32

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Wed, 07 Apr 2021 06:08:04 GMT
Server: nginx
ETag: "606d4c44-19aec"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 105196
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK 92088849.jpg
turkeyforfriends.com/_nw/26/ 299 KB
300 KB 105ms
105ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_nw/26/92088849.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 3bdd5b93b198bc22083a4d09ec725118383db8b19ea0d7f29476abb27b43486d

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Tue, 06 Apr 2021 05:10:39 GMT
Server: nginx
ETag: "606bed4f-4ad04"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 306436
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK 39727269.jpg
turkeyforfriends.com/_nw/26/ 147 KB
148 KB 104ms
103ms Image
image/jpeg 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/_nw/26/39727269.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 54da198d7e02f27bf6741cb6892f2222c5768583b0876866ebd4d1717f09a7e3

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 05 Apr 2021 05:30:38 GMT
Server: nginx
ETag: "606aa07e-24cd8"
Content-Type: image/jpeg
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 150744
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK ulogin.js Show response
ulogin.ru/js/ 54 KB
19 KB 487ms
181ms Script
application/x-javascript 95.163.118.168
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ulogin.ru/js/ulogin.js
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 95.163.118.168 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS: ulogin.ru
Software: nginx /
Resource Hash: b990748ef3bf77ccebc3af529f80b05aa5c449a28ba150c9f1fd58cae99900a2

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 21 Mar 2019 07:56:20 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=259200
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 13 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK sectigo.png
turkeyforfriends.com/bannery/ 3 KB
3 KB 98ms
98ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/bannery/sectigo.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 014428424f68097441548d1f3fcbed2f1f1fd52327e49c01bdb9dce25eed3353

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Sat, 20 Apr 2019 08:42:22 GMT
Server: nginx
ETag: "5cbadb6e-c53"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3155
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK v.png
turkeyforfriends.com/design/img/ 936 B
1 KB 99ms
97ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/v.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 0654553c4b28cec84bbab76ca705aa914a0d6a1ee2a260d672e19d015657b272

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 17 Oct 2016 18:50:35 GMT
Server: nginx
ETag: "58051d7b-3a8"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 936
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK f.png
turkeyforfriends.com/design/img/ 848 B
1 KB 93ms
93ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/f.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 82d9554002fbc6f25bb7f2ba93c3d74edf01603d21fade0240e39d3f7b1f3661

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 17 Oct 2016 18:46:53 GMT
Server: nginx
ETag: "58051c9d-350"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 848
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK t.png
turkeyforfriends.com/design/img/ 964 B
1 KB 97ms
97ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/t.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 58895f95d011c00799124ce30f06c38ed4234885a669b69f62ea643e056fe2e5

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 17 Oct 2016 18:49:36 GMT
Server: nginx
ETag: "58051d40-3c4"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 964
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK i.png
turkeyforfriends.com/design/img/ 1 KB
1 KB 90ms
90ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/i.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 69d6fd46c1f56b952eb64c1d21c8da3f47fb8a5f5d66f0a568dafa3d1ebea6da

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 17 Oct 2016 18:54:45 GMT
Server: nginx
ETag: "58051e75-454"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1108
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK youtube.png
turkeyforfriends.com/design/ 4 KB
4 KB 87ms
86ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/youtube.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: d9be69c0d0fc0065dd03801ea9de774eca6b35a05f89dd44abe1df53605d89a1

Request headers

Referer: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Tue, 13 Oct 2020 18:13:14 GMT
Server: nginx
ETag: "5f85ee3a-e52"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3666
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1

200
OK

hit;noadsuweb
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;noadsuweb?r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369
https://counter.yadro.ru/hit;noadsuweb?q;r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369

43 B
496 B

95ms
95ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit;noadsuweb?q;r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host210.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:15 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 09 Apr 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:15 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;noadsuweb?q;r;s1600*1200*24;uhttps%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;1618059255369
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Thu, 09 Apr 2020 21:00:00 GMT

GET
H/1.1 200
OK 7.png
turkeyforfriends.com/.s/t/798/ 430 B
757 B 90ms
90ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/t/798/7.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: bdbb3eb5659e27aff28f15ad2f3b094ff65027c2a0649278efd3927d1d9f1574

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 07 Apr 2014 12:53:02 GMT
Server: nginx
ETag: "53429fae-1ae"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 430
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK home.png
turkeyforfriends.com/design/img/ 5 KB
5 KB 255ms
98ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/home.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 1a0a3e39dc26349f8fdd8e1b48581dd8657e24f9e04b2101928203d14360eba6

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 16 Jun 2020 09:23:58 GMT
Server: nginx
ETag: "5ee88fae-131b"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4891
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK rentacar.png
turkeyforfriends.com/design/img/ 4 KB
4 KB 154ms
91ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/rentacar.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: fdc38bc7cade8c519bc3232c11102cf4d582acf30282966a213ad17c2d3ac3ef

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 16 Jun 2020 09:26:35 GMT
Server: nginx
ETag: "5ee8904b-1004"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4100
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK i-avia.png
turkeyforfriends.com/design/img/ 1 KB
1 KB 249ms
94ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/i-avia.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 7a002a62e8254d9457a83cb9f9060a2d32f5f91ccd401efadb03ef65f41535e4

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Thu, 06 Oct 2016 02:23:39 GMT
Server: nginx
ETag: "57f5b5ab-464"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1124
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK tury.png
turkeyforfriends.com/design/img/ 4 KB
5 KB 229ms
97ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/tury.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: addc630ee9eeebe2d1359bc48b22cec698a3fb19145fc0b8a125c82f90c3f9e4

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Tue, 16 Jun 2020 09:42:09 GMT
Server: nginx
ETag: "5ee893f1-117f"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4479
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK i-login.png
turkeyforfriends.com/design/img/ 2 KB
2 KB 502ms
295ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/i-login.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: ae54d6f9bc5c48d1df22581c7bcbf6dc657e54018127683781e59efca75e4c43

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Thu, 06 Oct 2016 02:23:48 GMT
Server: nginx
ETag: "57f5b5b4-7c7"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1991
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK i-reg.png
turkeyforfriends.com/design/img/ 2 KB
3 KB 213ms
91ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/i-reg.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 07b167891fe36ecbfb562e23e2c57a972afb0d22a1f7c1fce2176071bc1e68e3

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Thu, 06 Oct 2016 02:23:55 GMT
Server: nginx
ETag: "57f5b5bb-976"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 2422
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H/1.1 200
OK search-btn.png
turkeyforfriends.com/design/img/ 1 KB
2 KB 156ms
93ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/search-btn.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 420f362ee24fc2cd335decc4bce98708f6e3f357defd01df56aa413dcb106266

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Thu, 06 Oct 2016 02:23:58 GMT
Server: nginx
ETag: "57f5b5be-4fe"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1278
Expires: Fri, 30 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210406/r20190131/ 219 KB
82 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210406/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-9875317559664900&plah=turkeyforfriends.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd5713e27f4481988d37b5b719dedea4e4379ec3c3bafea0fba9d0abe8db4973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83926
x-xss-protection: 0
server: cafe
etag: 9615343531509228114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H/1.1 200
OK l.svg
turkeyforfriends.com/.s/img/icon/social/ 724 B
1 KB 96ms
96ms Image
image/svg+xml 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/icon/social/l.svg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/.s/src/social.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 3a3d6f2ba38ebf419d15a9f5bebd4f4f82a8988dce549ce4ec973581078bb21b

Request headers

Referer: https://turkeyforfriends.com/.s/src/social.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 26 Jun 2017 11:42:16 GMT
Server: nginx
ETag: "5950f318-2d4"
Content-Type: image/svg+xml
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 724
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK vk.svg
turkeyforfriends.com/.s/img/icon/social/ 772 B
1 KB 91ms
90ms Image
image/svg+xml 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/icon/social/vk.svg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/.s/src/social.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 05a3f8587400860aa87bb18c9a9cd5b22a45ca4fc4a37a7922d29e48549b2fc9

Request headers

Referer: https://turkeyforfriends.com/.s/src/social.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 26 Jun 2017 11:42:16 GMT
Server: nginx
ETag: "5950f318-304"
Content-Type: image/svg+xml
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 772
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK gp.svg
turkeyforfriends.com/.s/img/icon/social/ 550 B
881 B 87ms
86ms Image
image/svg+xml 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/icon/social/gp.svg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/.s/src/social.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: a657a4d5d05c6cd9b9f881ab6941e71f725c7eb451c9f37ceb514e45fdfd441d

Request headers

Referer: https://turkeyforfriends.com/.s/src/social.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Fri, 01 Feb 2019 12:57:26 GMT
Server: nginx
ETag: "5c544236-226"
Content-Type: image/svg+xml
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 550
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK fb.svg
turkeyforfriends.com/.s/img/icon/social/ 611 B
942 B 87ms
86ms Image
image/svg+xml 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/icon/social/fb.svg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/.s/src/social.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: a9265d79c9ff74d4deeab5dce9643ed838018a6b4346605e002867858534f4bf

Request headers

Referer: https://turkeyforfriends.com/.s/src/social.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 26 Jun 2017 11:42:16 GMT
Server: nginx
ETag: "5950f318-263"
Content-Type: image/svg+xml
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 611
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210406/r20190131/ Frame 37B2 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210406/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210406/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 14:15:42 GMT
expires: Fri, 23 Apr 2021 14:15:42 GMT
content-type: text/html; charset=UTF-8
etag: 10446291943670460780
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4644
x-xss-protection: 0
age: 81513
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 recaptcha__ru.js Show response
www.gstatic.com/recaptcha/releases/539Evs44yecoSf-lkJBQzKKj/ 367 KB
133 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/539Evs44yecoSf-lkJBQzKKj/recaptcha__ru.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=reCallback&render=explicit&hl=ru

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46fd206a3059094f068fa086639b6bcb2ce3362075d6311db23e618585e72556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://turkeyforfriends.com
Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 03:46:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 378455
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136427
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 04:03:42 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 06 Apr 2022 03:46:40 GMT

GET
H/1.1 200
OK vico-views.png
turkeyforfriends.com/.s/img/vi/ 1 KB
2 KB 90ms
90ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/vi/vico-views.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 351356b01316afb2c9f0c3e8d792162329519436a2858730065768defddf12e6

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 20 Feb 2017 09:40:48 GMT
Server: nginx
ETag: "58aab9a0-4ba"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1210
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H/1.1 200
OK vico-comments.png
turkeyforfriends.com/.s/img/vi/ 1 KB
1 KB 97ms
96ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/.s/img/vi/vico-comments.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 5816948dee3208a60270bb2762dfd75701e628c4536004f02b4edddc0165c3fc

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
Last-Modified: Mon, 20 Feb 2017 09:40:48 GMT
Server: nginx
ETag: "58aab9a0-4b4"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1204
Expires: Fri, 30 Apr 2021 12:54:17 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 210 B
268 B 74ms
74ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=turkeyforfriends.com&callback=_gfp_s_&client=ca-pub-9875317559664900

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210406/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-9875317559664900&plah=turkeyforfriends.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

ba67a90c9bf9cd9687d20cec4501b29f881290f97021b4d7647b8463cfa4c8d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9536 82 KB
25 KB 298ms
298ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=3125688885&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255446&bpp=45&bdt=622&idt=96&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3359245479880&frm=20&pv=2&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=858&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=VEwKMOYzKw&p=https%3A//turkeyforfriends.com&dtd=118

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2307e8dc2cddbeb686cd3432dc412f8f1bfaca2f33c01e26f87f083645c0e7af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=3125688885&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255446&bpp=45&bdt=622&idt=96&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3359245479880&frm=20&pv=2&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=858&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=VEwKMOYzKw&p=https%3A//turkeyforfriends.com&dtd=118
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:15 GMT
server: cafe
content-length: 25784
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 10-Apr-2021 13:09:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 10 Apr 2021 12:54:15 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12a84d53232f26ad8feb3dab55e480195520c092b9a8dc87baca96c7390d919b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988871915048"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28262
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A964 73 KB
24 KB 467ms
467ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b934c49532e2ee20661596c4ca9cc57187a5597883946a96db119cf14db7c5f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 24791
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 10-Apr-2021 13:09:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 10 Apr 2021 12:54:16 GMT
cache-control: private

GET
H/1.1 200
OK taf.js Show response
static.advcake.com/js/widgets/travelata/ 59 KB
59 KB 205ms
83ms Script
application/javascript 148.251.128.101
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://static.advcake.com/js/widgets/travelata/taf.js
Requested by: Host: c18.travelpayouts.com
URL: https://c18.travelpayouts.com/content?promo_id=1491&shmarker=14494&country=92&horizontal=false&animated=true&trs=21646&powered_by=false
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 148.251.128.101 Stuttgart, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: advcake.com
Software: nginx /
Resource Hash: 4274beb74e89b013f3373432b2f188c174111847d4886a34ee9144ff824c707b

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:15 GMT
Last-Modified: Thu, 18 Oct 2018 10:01:26 GMT
Server: nginx
ETag: "5bc859f6-ea37"
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59959

GET
H2 200 sp.js Show response
st.avsplow.com/19.18.9/ 42 KB
14 KB 39ms
16ms Script
application/javascript 2606:4700:20::ac43:44ed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.avsplow.com/19.18.9/sp.js
Requested by: Host: c18.travelpayouts.com
URL: https://c18.travelpayouts.com/content?promo_id=1491&shmarker=14494&country=92&horizontal=false&animated=true&trs=21646&powered_by=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:44ed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 953af01affd97621869fdb141a98da9fd0e2a1417ae0e3f27c0c3cd49032f5af

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 13753
cf-request-id: 095d71f73a000053646a3fc000000001
last-modified: Sun, 15 Nov 2020 04:17:16 GMT
server: cloudflare
etag: W/"5fb0abcc-a686"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=O2DJ56SuGKmyASR27qhLpbDy%2Bw1%2Br%2FjOp16vKEwqsPgcfQ2oLKemRcAWZ9jTtz6xgMJqvVYRwKr9WfdcjnAGMSFB%2F4YGoigAcPycZirN23Klax%2Bnv%2BDvK6fg%2Fw%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 63dc1f6b881e5364-FRA
expires: Sat, 10 Apr 2021 13:05:02 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Mar 2021 19:22:18 GMT
server: Golfe2
age: 62
date: Sat, 10 Apr 2021 12:53:13 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19463
expires: Sat, 10 Apr 2021 14:53:13 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 215 KB
68 KB 147ms
48ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

5acd5b0aefec349b8c705422b293122bb2e0e1bf77777463f565180e77ef2115

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: br
last-modified: Mon, 05 Apr 2021 18:52:27 GMT
etag: "60705d6f-11096"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 69782
expires: Sat, 10 Apr 2021 13:54:15 GMT

GET
H/1.1 200
OK code.js Show response
top-fwz1.mail.ru/js/ 21 KB
9 KB 239ms
80ms Script
application/javascript 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/code.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

97a78461a110f185b02d55e86b3d66a36eea60cfabbcc30fcda778c51ccfdce0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection: keep-alive
Access-Control-Allow-Headers: *
AMP-Access-Control-Allow-Source-Origin: *
Last-Modified: Fri, 09 Apr 2021 12:56:59 GMT
Server: nginx
ETag: W/"60704f1b-53b2"
Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Cache-Control: max-age=3600, private
Access-Control-Allow-Credentials: true
Accept-CH-Lifetime: 86400
Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory
Timing-Allow-Origin: *
Keep-Alive: timeout=60
Expires: Sat, 10 Apr 2021 13:54:15 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
146 B 15ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 16ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CE8B 14 KB
1 KB 104ms
104ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&adk=1812271804&adf=3025194257&lmt=1618058393&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&ea=0&flash=0&pra=5&wgl=1&dt=1618059255783&bpp=1&bdt=960&idt=1&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200&nras=1&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&dtd=7

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dea12df9c0baca5e76f71f4e107a2f80fda56e09c76ddf86fe52e16b356f125c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&adk=1812271804&adf=3025194257&lmt=1618058393&plat=1%3A32776%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&ea=0&flash=0&pra=5&wgl=1&dt=1618059255783&bpp=1&bdt=960&idt=1&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200&nras=1&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&dtd=7
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:15 GMT
server: cafe
content-length: 1091
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 10-Apr-2021 13:09:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 10 Apr 2021 12:54:15 GMT
cache-control: private

GET
H/1.1 200
OK scroll-top.png
turkeyforfriends.com/design/img/ 259 B
586 B 133ms
90ms Image
image/png 193.109.246.214
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://turkeyforfriends.com/design/img/scroll-top.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/new.css?4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.109.246.214 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, CY),
Reverse DNS: dev.ucoz.net
Software: nginx /
Resource Hash: 2b71b4053871ef753b0e8a283320bd43680c87d11f7dab5cd9b9ba8a745a1b8e

Request headers

Referer: https://turkeyforfriends.com/new.css?4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
Last-Modified: Wed, 12 Oct 2016 02:44:21 GMT
Server: nginx
ETag: "57fda385-103"
Content-Type: image/png
Cache-Control: max-age=1728000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 259
Expires: Fri, 30 Apr 2021 12:54:16 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
73 B 13ms
13ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j89&a=363493099&t=pageview&_s=1&dl=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&ul=en-us&de=UTF-8&dt=%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAEABAAAAAC~&jid=1143529485&gjid=1844825964&cid=1142909979.1618059256&tid=UA-15757825-1&_gid=390931232.1618059256&_r=1&_slc=1&z=2050789292

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://turkeyforfriends.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 serp Show response
traff.travelata.ru/application/destinationList/ 18 KB
2 KB 505ms
409ms Script
text/html 178.248.232.202
QRATOR

General

Check archive.org

Show headers Download Go to

Full URL: https://traff.travelata.ru/application/destinationList/serp?callback=_tafData
Requested by: Host: static.advcake.com
URL: https://static.advcake.com/js/widgets/travelata/taf.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.232.202 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 665ab0e00698d56e219a6574f67a09327e16ca80db3e33afd78dbe705f865f96

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: br
server: QRATOR
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
91 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-15757825-1&cid=1142909979.1618059256&jid=1143529485&gjid=1844825964&_gid=390931232.1618059256&_u=IAhAAEAAAAAAAC~&z=518333806

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 10 Apr 2021 12:54:15 GMT
content-type: text/plain
access-control-allow-origin: https://turkeyforfriends.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9536 4 KB
713 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=3125688885&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255446&bpp=45&bdt=622&idt=96&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3359245479880&frm=20&pv=2&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=858&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=VEwKMOYzKw&p=https%3A//turkeyforfriends.com&dtd=118

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Apr 2021 11:38:02 GMT
server: ESF
date: Sat, 10 Apr 2021 12:54:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 9536 1 KB
947 B 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:51:26 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame 9536 17 KB
7 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 9536 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9536 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 9536 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 1f3867f1f27527e43574e1cbaa2e66c3.js Show response
www.gstatic.com/mysidia/ Frame 9536 25 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1f3867f1f27527e43574e1cbaa2e66c3.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47266f5d8118cec1898402204dbdfa8d5a2343b6ceec8c2036ea1d86552d519b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Apr 2021 08:45:50 GMT
server: sffe
age: 179246
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10498
x-xss-protection: 0
expires: Wed, 07 Jul 2021 11:06:49 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
88 B 30ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-15757825-1&cid=1142909979.1618059256&jid=1143529485&_u=IAhAAEAAAAAAAC~&z=421548500

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 29ms
28ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-15757825-1&cid=1142909979.1618059256&jid=1143529485&_u=IAhAAEAAAAAAAC~&z=421548500

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9536 0
0 44ms
42ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CVwtB959xYI_OI9LKgAe40rCwBIr5j41iyKH9n9MNitGj7b4BEAEgnNbvBmCVAqAB35vyxQHIAQapAnS_-hk797M-qAMByAPLBKoEjwJP0Fvl1lXwisvxQzjeSVQu1zX6Ax5hcxa2L0m3icIUlsSY_Q65-wmzKf5LsrSCAkfJq6mr4EaoqexvSLIY3u1czl6JvkAsYPtKaVnJLJdUoavZCHG_Y8U4fj9sXpUfTST0eM7cPCSCJgW3SICOBsOfXZZLlik-RiH59Bsb9PwvqtlzkWAWSIu9DZQJ2mNHYwxBhmZR50gaLqHb-xRt1NqFASGE3EH4xWKTkZ3l5LyyYN4kxXRPzCz7uYABxPplE-cay8aCZ43PUQ139iF-SNgsljxtzyZrEExLbdg8JlhtxTVbnsch9EW1Qfqa8YQDSLRz7Dl9hKtiNTPvZbmKglxoAtSPL0hrNmzpuqg0QtoTwAT_hMLmtQOSBQQIBBgBkgUECAUYBKAGN4AHieSNugKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQg8gT0ggJCIDhgBAQARgfgAoByAsB2BMNiBQM0BUBgBcBshcaChgIABIUcHViLTk4NzUzMTc1NTk2NjQ5MDA&sigh=lJ1P1o1evD0&template_id=492&tpd=AGWhJmty0axGoCDQR4fD9x1-Bl7xNuuroirgMdxr6ZhvVJBBGQ

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=3125688885&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255446&bpp=45&bdt=622&idt=96&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3359245479880&frm=20&pv=2&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=858&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=VEwKMOYzKw&p=https%3A//turkeyforfriends.com&dtd=118
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:15 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/9534957602113731101/ Frame 9536 11 KB
11 KB 9ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9534957602113731101/downsize_200k_v1?w=400&h=209

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc7a93f99efec36fadb3c7414915c246ab84b7e2a2bcea9e54d2d8be4a3a92bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:35:01 GMT
x-content-type-options: nosniff
age: 8354
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11622
x-xss-protection: 0
last-modified: Fri, 05 Mar 2021 08:25:37 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Apr 2022 10:35:01 GMT

GET
DATA 200
OK truncated
/ Frame 9536 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb3c3715d0a176f1982fb344bea13a6b61f63f8e3ec93a6786187eea39a53378

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 9536 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 401936
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:20 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 9536 9 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:43 GMT
server: sffe
age: 401936
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:20 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 9536 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 19:15:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 322731
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
expires: Wed, 06 Apr 2022 19:15:25 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
46 B 38ms
38ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=5&wpc=ca-pub-9875317559664900&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=true&a=6%2C1%2C5%2C7&apv=20210407_113838&sat=1617984767278&afm=0&as_count=2&d_count=0&ng_count=0&am_count=5&atf_count=1&mdns=0.104&alldns=0.293&allp=55&fd=(0%2C38%2C22)%2C(2%2C3%2C2)&pgh=3855&su=turkeyforfriends.com&r=0.1

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
146 B 15ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 15ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=turkeyforfriends.com

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 52CB 81 KB
27 KB 855ms
854ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2b941574b23214cc694eebfed8a949d4400d03c82b4383dcb3726c7c56934d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 27196
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C599 132 KB
37 KB 509ms
509ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5e84568fe28f1653e662a7f9b2fb5246b12912d6659cda512f69795c5113f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 37352
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3428 66 KB
25 KB 470ms
470ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f7582f867dc787a49404bbc1d3d24e0744bbe334a437732f99c79d21d2cad85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 25668
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 72C1 59 KB
24 KB 372ms
372ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=1732375815&pi=t.aa~a.3910346740~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100&nras=5&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2245&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=vP2JuyzZpO&p=https%3A//turkeyforfriends.com&dtd=28

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e444aa12f911443b6786d1cd5edf74f0488b0e466c183335ed1b1dbe91630e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=1732375815&pi=t.aa~a.3910346740~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100&nras=5&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2245&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=vP2JuyzZpO&p=https%3A//turkeyforfriends.com&dtd=28
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 24439
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 80A7 66 KB
25 KB 503ms
503ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

460f1c7fc34d646086cbf555c52a2c8185370aa47fd969cffbfcede282e8049e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 10 Apr 2021 12:54:16 GMT
server: cafe
content-length: 25617
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame 97CA 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7742
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9239.W7bzqTDCjUlbTp8a9Cqb1XOFFzQNqI0ZJXEgeqm_gmWsjeU5DE1bssPVxv2Gy38y.UY8sEIDKl8BEcUCjKXZcOrwR5zc%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9239.iEHxZ8W_moYfsudiJMhb3HER67dYCjnZmrn635kpiaR-JHygmQJTxM7ESQqZOL6DUJITmRqWovWkaWaMqaEaKQ%2C%2C.4fuQlKEIROtTIAzDNnjYedGV2Vk%2C

75 B
75 B

55ms
54ms

Image
text/html

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9239.iEHxZ8W_moYfsudiJMhb3HER67dYCjnZmrn635kpiaR-JHygmQJTxM7ESQqZOL6DUJITmRqWovWkaWaMqaEaKQ%2C%2C.4fuQlKEIROtTIAzDNnjYedGV2Vk%2C

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9239.iEHxZ8W_moYfsudiJMhb3HER67dYCjnZmrn635kpiaR-JHygmQJTxM7ESQqZOL6DUJITmRqWovWkaWaMqaEaKQ%2C%2C.4fuQlKEIROtTIAzDNnjYedGV2Vk%2C
date: Sat, 10 Apr 2021 12:54:16 GMT
strict-transport-security: max-age=31536000
content-length: 0
x-xss-protection: 1; mode=block

POST
H/1.1 200
OK counter
top-fwz1.mail.ru/ 43 B
1 KB 79ms
79ms Other
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/counter?js=13;id=1204411;u=https%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;st=1618059255794;title=%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9;s=1600*1200;vp=1600*1200;touch=0;hds=1;flash=;sid=d3aea82103ca1bc6;ver=60.3.0;tz=-120%2FEurope%2FBerlin;ni=10//4g/0/0/;lvid=1618059256188%3A1618059256189%3A1%3Adfb57ba7c001dbef21015a8303300fbb;_=0.4238101788908393

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 10 Apr 2021 12:54:16 GMT
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Access-Control-Allow-Headers: *
AMP-Access-Control-Allow-Source-Origin: https://turkeyforfriends.com
Server: nginx
Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://turkeyforfriends.com
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Cache-Control: private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials: true
Accept-CH-Lifetime: 86400
Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory
Timing-Allow-Origin: https://turkeyforfriends.com
Keep-Alive: timeout=60

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
160 B 48ms
47ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
last-modified: Thu, 01 Apr 2021 13:57:39 GMT
etag: "60705d6f-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sat, 10 Apr 2021 13:54:16 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame A964 4 KB
685 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Apr 2021 11:49:51 GMT
server: ESF
date: Sat, 10 Apr 2021 12:54:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame A964 1 KB
979 B 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:51:26 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame A964 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame A964 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A964 118 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame A964 13 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 1f3867f1f27527e43574e1cbaa2e66c3.js Show response
www.gstatic.com/mysidia/ Frame A964 25 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1f3867f1f27527e43574e1cbaa2e66c3.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47266f5d8118cec1898402204dbdfa8d5a2343b6ceec8c2036ea1d86552d519b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 11:06:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Apr 2021 08:45:50 GMT
server: sffe
age: 179247
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10498
x-xss-protection: 0
expires: Wed, 07 Jul 2021 11:06:49 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame A964 0
0 44ms
44ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaZHV959xYInBJMyBx_APzdCA-A_7ksH9YO-GyuCvDPLEu-L3GxABIJzW7wZglQKgAfTazJkDyAEGqQJ0v_oZO_ezPqgDAcgDywSqBJ0CT9B3jSyumeyIGBZ7PPzQmhjIxnpa-Y5o0wFtae1TQbb5a9r8ShFfZ03PYH3jm3B5wrWNNdhnSepdfsqhSemV0W0m5sIagQFFOOS5RcuQ2_84JCQlKolC8U7xhoiqH29TjaYd3qCT0f8SIMlZEsHG-V0rdxkb87zLVvM8kUYzJUqbZ4-KcomcrdLp1YrdsxkOhvqukTt-YKUbQFIw_NBNdzrEPExG05uBKnkWzF8eKaS_9nKJujJZrJYwsTpT6ootzAgLvs7PoVKHQk-eGsbG-V-uQJo0w7ziCRIVIutFgslpWGDCe6EGz9IZqOdXArYCTSr5NtVjWyNh2hrtmnt368wtaOwQHQNYymNgTTi2Tyv4duSMdSIzJx5DIjQMwASkjOODrAOSBQQIBBgBkgUECAUYBKAGN4AH9KSzZqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBC5pRfSCAkIgOGAEBABGB-ACgHICwHYEwyyFxoKGAgAEhRwdWItOTg3NTMxNzU1OTY2NDkwMA&sigh=iRIfA_0JDZU&template_id=492&tpd=AGWhJmu3TjzjtetsHpkBjE3uJIUd9ciG3kZp4tN3ILsP5NS21g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11229461024822028242/ Frame A964 19 KB
19 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11229461024822028242/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88d52e0262728e44a89739f8b5ebb1ee69e218f461f8f71e8fef906e7b189df8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 02:07:01 GMT
x-content-type-options: nosniff
age: 211635
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19694
x-xss-protection: 0
last-modified: Mon, 10 Aug 2020 15:28:15 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Apr 2022 02:07:01 GMT

GET
DATA 200
OK truncated
/ Frame A964 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4582dae9b2df6cf37f84f6c3b4ab00f39bea91d60f81c288e1a6f9e6b9486f36

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A964 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 401936
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:20 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A964 9 KB
10 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:43 GMT
server: sffe
age: 401936
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:20 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame A964 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 19:15:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 322731
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
expires: Wed, 06 Apr 2022 19:15:25 GMT

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame DB72 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=200&slotname=6259500602&adk=3479312165&adf=1708966872&pi=t.ma~as.6259500602&w=821&fwrn=4&lmt=1618058393&rafmt=11&psa=0&format=821x200&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&wgl=1&dt=1618059255492&bpp=2&bdt=668&idt=85&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=821x200&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&rplot=4&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1481&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&pvsid=2770646969613593&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=HQ2ggjMm1r&p=https%3A//turkeyforfriends.com&dtd=89

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7742
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/4502077/
Redirect Chain

https://mc.yandex.com/watch/4502077?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&br...
https://mc.yandex.com/watch/4502077/1?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&...

219 B
331 B

52ms
51ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/4502077/1?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afp%3A1475%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A983972087457%3Ahid%3A1017741564%3Az%3A120%3Ai%3A202104010145416%3Aet%3A1618059256%3Ac%3A1%3Arn%3A483372173%3Au%3A1618059256274837472%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618059253938%3Ads%3A66%2C194%2C340%2C1%2C283%2C0%2C%2C970%2C1%2C%2C%2C%2C1856%3Adsn%3A65%2C194%2C340%2C1%2C283%2C0%2C%2C972%2C1%2C%2C%2C%2C1856%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618059256%3At%3A%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

b42518dc77c4945de01e0fa6c5cff76993018e34701d47c32d67ebaa1c246834

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
x-content-type-options: nosniff
last-modified: Sat, 10-Apr-2021 12:54:16 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 219
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:16 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
last-modified: Sat, 10-Apr-2021 12:54:16 GMT
location: /watch/4502077/1?wmode=7&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afp%3A1475%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A983972087457%3Ahid%3A1017741564%3Az%3A120%3Ai%3A202104010145416%3Aet%3A1618059256%3Ac%3A1%3Arn%3A483372173%3Au%3A1618059256274837472%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618059253938%3Ads%3A66%2C194%2C340%2C1%2C283%2C0%2C%2C970%2C1%2C%2C%2C%2C1856%3Adsn%3A65%2C194%2C340%2C1%2C283%2C0%2C%2C972%2C1%2C%2C%2C%2C1856%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618059256%3At%3A%D0%98%D0%BD%D1%82%D0%B5%D1%80%20%D0%A0%D0%B8%D1%8D%D0%BB%D1%82%D0%B8%20%D0%A2%D1%83%D1%80%20%E2%80%93%20%D1%82%D1%83%D1%80%D0%B8%D0%B7%D0%BC%20%D0%B8%20%D0%BD%D0%B5%D0%B4%D0%B2%D0%B8%D0%B6%D0%B8%D0%BC%D0%BE%D1%81%D1%82%D1%8C%20%D0%B7%D0%B0%20%D1%80%D1%83%D0%B1%D0%B5%D0%B6%D0%BE%D0%BC%20%7C%20%D0%A2%D1%83%D1%80%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D0%B4%D1%80%D1%83%D0%B7%D0%B5%D0%B9
strict-transport-security: max-age=31536000
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:16 GMT

GET
H2 200 firmVertBg.jpg
traff.travelata.ru/img/ 32 KB
33 KB 438ms
437ms Image
image/jpeg 178.248.232.202
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traff.travelata.ru/img/firmVertBg.jpg
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.232.202 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: aa9c9d48f0700006b448dec420c57cb01870d2eb6391703fd5679dcff848c06c

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
last-modified: Thu, 17 Dec 2020 17:37:09 GMT
server: QRATOR
accept-ranges: bytes
etag: "5fdb9745-8168"
content-length: 33128
content-type: image/jpeg

GET
H2 200 headerVert.png
traff.travelata.ru/img/ 7 KB
7 KB 291ms
291ms Image
image/png 178.248.232.202
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traff.travelata.ru/img/headerVert.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.232.202 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: b8f89f6286433e47ae35468f1fb5998670cea2323df60070bcbcea6a6ce24709

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
last-modified: Thu, 17 Dec 2020 17:37:09 GMT
server: QRATOR
accept-ranges: bytes
etag: "5fdb9745-1acb"
content-length: 6859
content-type: image/png

GET
H2 200 calBig.png
traff.travelata.ru/img/ 229 B
361 B 293ms
293ms Image
image/png 178.248.232.202
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traff.travelata.ru/img/calBig.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.232.202 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 9ea613d68962c2b8fd9e265d0438642127824e6f7ed6b0de44aef7526708a964

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
last-modified: Thu, 17 Dec 2020 17:37:09 GMT
server: QRATOR
accept-ranges: bytes
etag: "5fdb9745-e5"
content-length: 229
content-type: image/png

GET
H2 200 searchButtonRight.png
traff.travelata.ru/img/ 1 KB
2 KB 286ms
285ms Image
image/png 178.248.232.202
QRATOR

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://traff.travelata.ru/img/searchButtonRight.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.248.232.202 , Russian Federation, ASN197068 (QRATOR, RU),
Reverse DNS
Software: QRATOR /
Resource Hash: 2a54fba5d9fa19b52f7a334a5caf15d15fc648aad383424b060e55d977cfcfde

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
last-modified: Thu, 17 Dec 2020 17:37:09 GMT
server: QRATOR
accept-ranges: bytes
etag: "5fdb9745-5f8"
content-length: 1528
content-type: image/png

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3A4A 0
0 198ms
91ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuOgOOJYSMDvBWlBTkHcCRpYh-xOpxVf-a-IpPjm_BkdEVMxpYbauZPVKgfC4YUdMFnNyugkZrlDt0Z7Pbdfnuq8cbAMxf5GWj15GSML56Hb-W1Eti5UQ9w0IN8Udcb-1Ri2ml7wabfDCv3NTHjxxjgX9sZUFVs7VL4DGoV0CJ3L3r4VkUqwLjKI-IiF9UxRgdyn5Etl8JoJs_KNDz7Fr-kx25jzhTTiwEUaNCXrKZvz6AYumtj2VeNOMphivc23GOtyASLd9BZ0fkCPKiUWf0kR6h2d5R7nTvMuO5HWpHr4LDo99k6scr6Vupkq0LkOL1SXe-nnm4J3XaLlX14Qsa5hpcjjiUkmpJcixj4KNnl-mvSaJgcpiNuVtUW6MaWImizN3R9l27L_Yl_ko2Xu7dWrPU_mUEVzynidhLOkIP2f1kzjveDMCBIhv5hgD70rrnyzvu2qKKFN68ZAPoVfI3emPtZgm0q8nlx6m2MeEWdvb05qtFOR9iHC2dOkXc2b7jHUZ5zhMh8APmrp3cuQzkubS13F2OJZnBp3RQJTcpIAUUoZ6B0lBLwpP2_VsoBpaEkx46Lr3Q7PEqJ7Z7yHJA4rHOTDNUPi1BOU_FWLB2QxrkD3gSoQRaVAkI4dlJgSaTMlTL-gKtrpcXPj9Foz-b80EtTbwa_qL-k8FwKcED86NhSLE4ASIG1l1oVRssoI338g985HSuVYWnODrLx9ga__6hFV18MovcUIpqGbxZFRXZfvPc7Jg3VLmBO02PG6GZKqtIY9k1UGeW6_i3ttzzJK2N6eyprkGebLT_MEmIVqA5SgLAewhBMv2YTPqLjKJr1lyIpzzYEjljWFsx4fAW2WkHApGB_AjmRp34oaQA5n6nvvad0eMMRc-3AxWgXq_O94sp90teCAsfVqpowjyVrmpTBg9VE242j8WYwviL6M4kfQphg0al3ZxVq4rVCUaDW_hJIpqb2cAJoTLcNuKN5xqWAPc0DHO-GROymA2T9tZFEVIQ0YBdRGsi2S1t_ts9pUIZGEjGeoFaUap_hHRkL3p-URaQr_aUl-7RaMFwStSev6OMVxKsIiculuhE4nFR_5ORiqVaNTkV0F2un_GIoz5Zvmym4V2FjUertiwXmtxPFFRBGJ_A&sig=Cg0ArKJSzN5LDoM1AESdEAE&urlfix=1&adurl=&tpd=AGWhJmsa0ZiST4TbcwpV2gPN-xY3j6SsQBaJCa9WnN3L5_-I3w

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sat, 10 Apr 2021 12:54:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 3A4A 111 KB
39 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 06:52:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21685
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Apr 2021 06:52:51 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3A4A 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 07:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21191
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Apr 2022 07:01:05 GMT

GET
H3-Q050 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3A4A 30 KB
12 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=1732375815&pi=t.aa~a.3910346740~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100&nras=5&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2245&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=vP2JuyzZpO&p=https%3A//turkeyforfriends.com&dtd=28

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b50775a86effc03381449c6753c834fe2ab4f4b85fdcd434b0063856612d2d03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:51:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12019
x-xss-protection: 0
server: cafe
etag: 14063525893811147733
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:51:46 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3A4A 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3A4A 118 KB
36 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3A4A 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame 3A4A 17 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 005C 1 KB
755 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 16:59:40 GMT
expires: Sat, 10 Apr 2021 16:59:40 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 71676
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B9F3 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sat, 10 Apr 2021 07:01:18 GMT
expires: Sun, 10 Apr 2022 07:01:18 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 21178
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3A4A 0
23 B 39ms
39ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=30&d=1&s=1&f=0.01&bgai=B2Dbv-J9xYPy2B4HWgAfE4Jj4CwAAAAA4AeAEAg

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 3A4A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e227608ddb22f360b351b383ab3c73a94c725157de44010717d95fbc29c1c42a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.jpg
s0.2mdn.net/6418128/ Frame 3A4A 4 KB
5 KB 34ms
20ms Image
image/jpeg 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/6418128/DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.jpg

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f81587ccc93a8918bb1208ead1ce43f5bb0a3e1c722010aef8e123318e04fec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 13:55:06 GMT
x-content-type-options: nosniff
last-modified: Mon, 30 Nov 2020 12:07:12 GMT
server: sffe
age: 82750
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4569
x-xss-protection: 0
expires: Sat, 10 Apr 2021 13:55:06 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 005C 35 B
464 B 10ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJy-_gy5n6FHX5reCacnRGQ&google_cver=1&google_push=AQvitUJtFUX1JISAI9mnwAzRcw1ciWEXt9ANNm-PotX3KHNsnts7tHpz3VKg8dw16fljmIlS1L7p_nOX_ASz-592TkLJLsAD6V4SCg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 005C
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAQvitUKKL_UMccKEiHHXJY2CbIhSlDLxlLgUa1A2nizRBTMaKfhn22Hb53EgonX7lNGJZhVOdTVmzaSkeI0DtkyILXOEujtwGKrt_g&google_gid=CAESELk0gv-bzoQuMxY0NZcJTas&g...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPi_xoMGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BUXZpdFVLS0xfVU1jY0tFaUhIWEpZMkNiSWhTbERMeGxMZ1VhMUEybml6UkJUTWFLZmhuMjJIYjUzRWdvblg3bE5HSlpoVk9kVFZtemFTa2VJMER0a3...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRG9fY24wRFYzbnpibi04WFh2TnpZREpVOW9OS21NSmxfVHJWRHgyaUs0Yw==&google_push

170 B
213 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRG9fY24wRFYzbnpibi04WFh2TnpZREpVOW9OS21NSmxfVHJWRHgyaUs0Yw==&google_push

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 10 Apr 2021 12:54:16 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRG9fY24wRFYzbnpibi04WFh2TnpZREpVOW9OS21NSmxfVHJWRHgyaUs0Yw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 005C
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUIR2_LD...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUIR2_LD...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc4MDgzMDYyNDIwMTU5Ng%3D%3D&google_push=AQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00V...

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc4MDgzMDYyNDIwMTU5Ng%3D%3D&google_push=AQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00VSkrnM_5hZ8rhu9_Fpaii_ivvRUVnfUeA

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc4MDgzMDYyNDIwMTU5Ng%3D%3D&google_push=AQvitUIR2_LDoS2QpwHPosdbkOd3KcYJYP_d6gY77SU6T2nAe2T09tvl0tyVNA_LsMy00VSkrnM_5hZ8rhu9_Fpaii_ivvRUVnfUeA
Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 005C
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ
https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIc...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

170 B
213 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:15 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKDJmAEPfxuP3eWO_cVMBBvuWvW-oan7FaN1weylufTW1t54gN9gFFFcGnj0Nu4cJU-dZlbA5UjyK-57kmKUeQ7QX70nGBIcQ&google_hm=zwMX6vXsxF8gu_JpaYNrxg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: ntohtv72hp945hdc81t54uscl0gf8skn

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 005C
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
190 B

60ms
59ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJpEH9lR-CRFLofJvw_k_V_qlZZDyoAbkwdwLDXWFl6Ue8eK9_OH0W5xw0GTKSbeSX_vtyUdhvnpD6OKTnyrx6DrtujqkS2Pw

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJpEH9lR-CRFLofJvw_k_V_qlZZDyoAbkwdwLDXWFl6Ue8eK9_OH0W5xw0GTKSbeSX_vtyUdhvnpD6OKTnyrx6DrtujqkS2Pw
Date: Sat, 10 Apr 2021 12:54:16 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 005C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_push=AQ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeX...

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeXBzFyS7nMqDlr-CQQDATs_mHuIgBvOtLQtG6NzAD6U15Vl7mRPiwSI-5-W_Ann4ARg

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUJaH0e8EdaEu7hCUjlKJwkb1l3wnyIeXBzFyS7nMqDlr-CQQDATs_mHuIgBvOtLQtG6NzAD6U15Vl7mRPiwSI-5-W_Ann4ARg
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 462
Expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H2 200 trk
ag.innovid.com/ Frame 005C 43 B
294 B 20ms
19ms Image
image/gif 2a05:d01c:1d8:8101:ac20:41f1:bf24:9b3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEFxLJeSENIDUsnbE5XuUpbM&google_cver=1&google_push=AQvitULeBJR-a5e_8emhprH-VyF6w5TfVcmCcrjEkPcZGqiJKH2-w6gGyvhdGQj8Zse9Rz7UBzqpLBXqAnAIOC9ppgXHFYA29SGppQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=1732375815&pi=t.aa~a.3910346740~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100&nras=5&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2245&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=vP2JuyzZpO&p=https%3A//turkeyforfriends.com&dtd=28
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:ac20:41f1:bf24:9b3 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 005C 0
40 B 51ms
51ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J6snsnm_okDvggGEN9FG-OsP5VV34KylevGx1rYcQPgJwkiyfeqLntbE1mvr5uN51cHvxo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 12471502657708349117
tpc.googlesyndication.com/simgad/ Frame 3428 9 KB
9 KB 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12471502657708349117?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkKrS5iQJbW63uCLJZp0nvo4etJNw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

482482de4e30d44d002c2974ac86d777849d405250eef21933aca95ef89baf09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 06:58:48 GMT
server: sffe
age: 211874
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9444
x-xss-protection: 0
expires: Fri, 08 Apr 2022 02:03:02 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame 3428 17 KB
7 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3428 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3428 118 KB
36 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3428 13 KB
5 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 3428 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQRiZ7qLnFyZrrcEBaVeqg0L8w6_87cPyol_Vgeymu92nh2WTMg3ZKj22F__-w6txd27Wkyy0tmWpSMD-9XsAfdYpneqA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 3428 25 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4379d5f31e3f6afe959f9b9a7f92c2b482dbddff7f95a73abf78066dc7d7facc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:07:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10481
x-xss-protection: 0
server: cafe
etag: 6535096331343443408
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:07:25 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3428 0
0 45ms
44ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CX56_-J9xYKCcB4GtgAfYwpv4DMyggf1gy_HE7cQNv-EeEAEgnNbvBmCVAqAB69Wo4QHIAQKpAnS_-hk797M-qAMByAPJBKoEmAJP0K92rl_0bovhn-zbR5nAObprX-UhXxCac-Sdt3_iUkXtyzo7By8sX6Ap-cZ3jP9oJd9qB-cW6oMUNLQSieA0x_ZHjBUUABh03d4NRMJ6arv_9VHmKt-TWy1M8uEMnaORwM-IsWOdbHjyGNm7kt9KZj9_HvJD904aDreBLHYEYZbYvnkLNVyg42mzQWhC9sxzufqKLcw1DBNqdlgmVijcvzvytlo2CboyJsxPn1Ebe9oup8SQEG9cnc_uGRlqBS-y49nErH_tmDEO4lR0PgbcuyR6zf1zF8bCXGOjV5SRY5QdUbR0s9asPnHGc4xrd-KnN8Q4WfFd4gpgnFooaE2kMSHSmdfFA3xPzgZCct1hFcR_Rt9Ov_qmwATYgNDVsAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHyuTXngKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQipwG0ggJCIDhgBAQARgfgAoByAsB2BMNshcaChgIABIUcHViLTk4NzUzMTc1NTk2NjQ5MDA&sigh=x_0wtU4fht0&tpd=AGWhJmvjCDvwVStVWA0GpFrybhlz7Pv9_kfzu3KLD12OrnXkRw

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 31b4ea2bd2a51d39610fc8aa214e4119.js Show response
www.gstatic.com/mysidia/ Frame C599 6 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/31b4ea2bd2a51d39610fc8aa214e4119.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1152be785978aa809034ab61de86ce4d03c5a301c95e96995e336d2462832a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 02:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 124958
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2779
x-xss-protection: 0
expires: Thu, 08 Jul 2021 02:11:38 GMT

GET
H3-Q050 200 b2ad9e2117aedd5ce941a2862458374c.js Show response
www.gstatic.com/mysidia/ Frame C599 142 KB
52 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b2ad9e2117aedd5ce941a2862458374c.js?tag=video_mra/web_raspberry

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0fd989ea582357754166789b3e0a896f231d21f237a6356671492f4b2bec8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 02:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 124958
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53415
x-xss-protection: 0
expires: Thu, 08 Jul 2021 02:11:38 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame C599 3 KB
600 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Apr 2021 11:37:18 GMT
server: ESF
date: Sat, 10 Apr 2021 12:54:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame C599 3 KB
601 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8d9b4e8baf2d6296710fb142486efc074d1b4295512aa4125465410dbfd1053a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Apr 2021 11:33:47 GMT
server: ESF
date: Sat, 10 Apr 2021 12:54:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame C599 1 KB
911 B 12ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:51:26 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame C599 17 KB
7 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame C599 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame C599 67 B
179 B 12ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 09 Apr 2021 22:41:50 GMT
x-content-type-options: nosniff
server: cafe
age: 51146
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Sat, 10 Apr 2021 22:41:50 GMT

GET
H3-Q050 200 DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.html Show response
s0.2mdn.net/6418128/1606738030413/ Frame 0624 4 KB
1 KB 9ms
9ms Document
text/html 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6418128/1606738030413/DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a0b459a26379ccd40bfd9ae5e02385abb0073eea2ae6f0fbc83c0792fafe08a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /6418128/1606738030413/DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1362
date: Sat, 10 Apr 2021 01:53:20 GMT
expires: Sun, 11 Apr 2021 01:53:20 GMT
last-modified: Mon, 30 Nov 2020 12:07:10 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 39656
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 12471502657708349117
tpc.googlesyndication.com/simgad/ Frame 80A7 9 KB
9 KB 7ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12471502657708349117?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkKrS5iQJbW63uCLJZp0nvo4etJNw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

482482de4e30d44d002c2974ac86d777849d405250eef21933aca95ef89baf09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 06:58:48 GMT
server: sffe
age: 211874
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9444
x-xss-protection: 0
expires: Fri, 08 Apr 2022 02:03:02 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame 80A7 17 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 80A7 2 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 80A7 118 KB
36 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 80A7 13 KB
5 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 80A7 25 KB
10 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4379d5f31e3f6afe959f9b9a7f92c2b482dbddff7f95a73abf78066dc7d7facc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:07:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10481
x-xss-protection: 0
server: cafe
etag: 6535096331343443408
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:07:25 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 80A7 0
0 45ms
42ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C4v5p-J9xYIrACLahx_APq_CP2A3MoIH9YMvxxO3EDb_hHhABIJzW7wZglQKgAevVqOEByAECqQJ0v_oZO_ezPqgDAcgDyQSqBJcCT9Dyjr_Ygcbfat3GMLgCPA-yoGsv4bmVxJufdibo1rKBnJ9l_EbBbYKhoEykCrxias_11-jmE0ySoU7XbatOIFg_qyhc4gYNfQYLKVytqHNT_JNDo1edTENN4NkZd1W5PJejPrTLtoXIyF1XAf_qFJUNcHouwwfioad9vgdM03z8ciwxukGF-MOikNMZ93uCnyoQLHTbw9R-yiX7fsWMzDgVzyKANuCWfPmtVacZU5ysO9EmxDYFra1LUhZIRLbWdWPiRCJbvYftb2lyyx_UGAJj4FGSkWXI9qA4dAxt0MyNoB1jmFJywh_9f2OJq9DEzrEawIKSe-lmLewB3Tu5JZhfcVwhDRj69IMxApKs1L6OUSczfI7vwATYgNDVsAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHyuTXngKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ04wE0ggJCIDhgBAQARgfgAoByAsB2BMNshcaChgIABIUcHViLTk4NzUzMTc1NTk2NjQ5MDA&sigh=fwXHeS2ATBc&tpd=AGWhJmtf4DhyIercHy3SAOGDAOe2WSChmjLoLBM4kdSbgkls-g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 117D 143 B
216 B 10ms
8ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=100&adk=428881886&adf=3820706613&pi=t.aa~a.3910345727~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x100&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250&nras=4&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=1845&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=k2vqamL47T&p=https%3A//turkeyforfriends.com&dtd=24

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 10 Apr 2021 12:41:26 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 770
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6F4E 1 KB
750 B 10ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 16:59:40 GMT
expires: Sat, 10 Apr 2021 16:59:40 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 71676
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame B9F3 14 KB
6 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7742
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C599 118 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:16 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame C599 13 KB
5 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 a0b5068ca1fc7f6ff765c7833258ec42.js Show response
www.gstatic.com/mysidia/ Frame C599 25 KB
10 KB 13ms
6ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a0b5068ca1fc7f6ff765c7833258ec42.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

789a93f4315357995e96053e32ee793d6b12f592fad617bb04f795c750f0c3bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 01:36:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 127091
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10491
x-xss-protection: 0
expires: Thu, 08 Jul 2021 01:36:05 GMT

GET
DATA 200
OK truncated
/ Frame 3428 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a990434ac6098c71397d74d83fc6080048c9abbfb7d649d2ffb9ecc91fe70cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/3200160035678753905/ Frame C599 2 KB
2 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3200160035678753905/downsize_200k_v1?w=100&h=100

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33102e31bbad99c1969aa00d12e6cb01540aad74e5008eede7c5ec395b233263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 10:05:03 GMT
x-content-type-options: nosniff
age: 96553
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1567
x-xss-protection: 0
last-modified: Fri, 26 Feb 2021 13:21:57 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Apr 2022 10:05:03 GMT

GET
DATA 200
OK truncated
/ Frame C599 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 204 csi
csi.gstatic.com/ Frame C599 0
331 B 210ms
84ms Other
image/gif 2a00:1450:4003:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~knbqpcys&c=6228825375471&slotId=3114412687735.5&qqid=CMzNvrnc8-8CFU1B4Aod5NQDIQ&sei=44726389%2C44729911%2C44730425%2C44730426%2C75259407%2C75259408&nsei=44714510%2C75259405%2C447279544&bi=rda&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/b2ad9e2117aedd5ce941a2862458374c.js?tag=video_mra/web_raspberry
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4003:80c::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/10001643310385379871/ Frame C599 95 KB
95 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10001643310385379871/downsize_200k_v1

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d39f2e864e1fd1b5dabe9fa196ea8a8faed786e76a1200efd17416160ee7f663

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 16:18:48 GMT
x-content-type-options: nosniff
age: 160528
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97327
x-xss-protection: 0
last-modified: Thu, 04 Mar 2021 09:31:20 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Apr 2022 16:18:48 GMT

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame C599 0
0 44ms
43ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C6qcq-J9xYMzxBs2CgQfkqY-IAor5j41iyKH9n9MNhbzKv48OEAEgnNbvBmCVAqAB35vyxQHIAQmpAnS_-hk797M-qAMByAPLBKoEkwJP0K_H7s7j0FEGlYjUPdzXVBH5oLJLtk7E6-RMTDJTfF-tAeJn-0rrZHG0eadvc2sce7VgxqSBxAK8_wEITLXH8Xd3JfMQz11bkPwWdEduNfadneSVjW72Dgconb4bcipgCFHQ9JEVGDr7_Y_UX-8QuK9QY-e3OQ59bZkAIk_GUMVAk5T0f0UJrJkDKCyhXIVVYZTBLHZpautLmA3P_EYqs1-X_SeTddSBa_-Lfmzk01-TxjtheP6qWD_M51jKjOB3aPL1uHjemO3tFogbhEnQTg1Ysc8FMKailpwsh3ua4m8aS_NEql4y2-PFoaQlDIGZGyCTHnfXEbn_Wjfd8drLIzGFtlUE27-mEOCJVbISDvKZH8AE_4TC5rUDkgUECAQYAZIFBAgFGASgBi6AB4nkjboCqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEIrNEdIICQiA4YAQEAEYH4AKAcgLAdgTDYgUDLIXGgoYCAASFHB1Yi05ODc1MzE3NTU5NjY0OTAw&sigh=UPnFZLuRfGo&template_id=3484&tpd=AGWhJmvL9kASXWsH6RpmTucs8-z7J7VJNr_kPhj-4KNIi5vIWg

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E4B1 1 KB
750 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 16:59:40 GMT
expires: Sat, 10 Apr 2021 16:59:40 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 71676
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CEE1 143 B
165 B 6ms
6ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 10 Apr 2021 12:41:26 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 770
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 16C6 1 KB
750 B 6ms
5ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 16:59:40 GMT
expires: Sat, 10 Apr 2021 16:59:40 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 71676
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050

206

videoplayback
r4---sn-4g5edns7.gvt1.com/ Frame C599
Redirect Chain

https://redirector.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=ip,ipbits,expire,id,...
https://r4---sn-4g5edns7.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,m...

972 KB
972 KB

17ms
7ms

Media
video/mp4

2a00:1450:4001:68::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5edns7.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=7FEB316F8BEB598D271F44EE90A2957B0287C7D0.5859D952329BE70283751124F6C055086F22F532&key=cms1&cms_redirect=yes&mh=-L&mip=2a01:4f8:192:5414::2&mm=28&mn=sn-4g5edns7&ms=nvh&mt=1618058699&mv=u&mvi=4&pl=49

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:68::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

ed9aa2388d539ab7cd9a5ca03fa4d8df570c369de129b62a6b0b1aa926677225

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
x-content-type-options: nosniff
last-modified: Thu, 04 Mar 2021 20:43:29 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-995264/995265
client-protocol: quic
cache-control: private, max-age=6899
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 995265
expires: Sat, 10 Apr 2021 12:54:17 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-4g5edns7.gvt1.com/videoplayback?id=f1c5e683af2b0d00&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1618066456&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=7FEB316F8BEB598D271F44EE90A2957B0287C7D0.5859D952329BE70283751124F6C055086F22F532&key=cms1&cms_redirect=yes&mh=-L&mip=2a01:4f8:192:5414::2&mm=28&mn=sn-4g5edns7&ms=nvh&mt=1618058699&mv=u&mvi=4&pl=49
cache-control: no-cache, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 707
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 rda_video_bg_pattern.png
googleads.g.doubleclick.net/pagead/images/ Frame C599 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/images/rda_video_bg_pattern.png

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7f42fd7e961148cbacb3643b669d55768ded74e587cd30d429a4e8112c05a5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=250&adk=3278916081&adf=3254788951&pi=t.aa~a.2909434725~rp.1&w=327&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=327x250&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280&nras=3&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1058&ady=1318&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Sx42wT62UF&p=https%3A//turkeyforfriends.com&dtd=20
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 09 Apr 2021 20:51:22 GMT
x-content-type-options: nosniff
server: cafe
age: 57774
etag: 9923804599063086578
vary: Accept-Encoding
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2033
x-xss-protection: 0
expires: Sat, 10 Apr 2021 20:51:22 GMT

GET
DATA 200
OK truncated
/ Frame 80A7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2594dd3b34fb2b3dbe53b3c52fb241284fbda363437c1d3610e18feb879465fb

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C599 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ef0cc81c995212f5e58167cffab64c44ee1456bbaa968357e74b4ff6512d839

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame C599 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 96640
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Sat, 09 Apr 2022 10:03:37 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 52CB 3 KB
646 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 10 Apr 2021 11:54:23 GMT
server: ESF
date: Sat, 10 Apr 2021 12:54:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 52CB 1 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:51:26 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/ Frame 52CB 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:48:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7114
x-xss-protection: 0
server: cafe
etag: 17914786394753848863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:48:34 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 52CB 2 KB
2 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:50:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:50:47 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 52CB 118 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1617988883687958"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36710
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/ Frame 52CB 13 KB
6 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210406/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5599
x-xss-protection: 0
server: cafe
etag: 2241650964481140939
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Apr 2021 12:54:08 GMT

GET
H3-Q050 200 a0b5068ca1fc7f6ff765c7833258ec42.js Show response
www.gstatic.com/mysidia/ Frame 52CB 25 KB
10 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a0b5068ca1fc7f6ff765c7833258ec42.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

789a93f4315357995e96053e32ee793d6b12f592fad617bb04f795c750f0c3bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 01:36:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 01:23:38 GMT
server: sffe
age: 127092
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10491
x-xss-protection: 0
expires: Thu, 08 Jul 2021 01:36:05 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6F4E 35 B
210 B 10ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJy-_gy5n6FHX5reCacnRGQ&google_cver=1&google_push=AQvitULMPOHPCRwJSvO7ncxXk59IMCnDaFfNhAWq9x5qazptbdyIk2lzPwF9zkRLEmjqWxkqUW08N4SmgEnkRgQI3k2Ktsc620t9

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcN...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFCSzh2a2tiTQ&google_push=AQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcNqa0LVAvz7EAt19DKBHH9wGnVB8vEV-gKKu1O7ckCqbjM9lNoQ1Np_n5aL

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFCSzh2a2tiTQ&google_push=AQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcNqa0LVAvz7EAt19DKBHH9wGnVB8vEV-gKKu1O7ckCqbjM9lNoQ1Np_n5aL

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFCSzh2a2tiTQ&google_push=AQvitUJUPRwAKk-tYMlZlQadxrLZh3MW3K36VmFfDcNqa0LVAvz7EAt19DKBHH9wGnVB8vEV-gKKu1O7ckCqbjM9lNoQ1Np_n5aL
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUKePnji-bQHWwTTORB2hzDPcwWH338OWxjNJGFf9k9jBfkJwhJy1HNB9CWYxal-6uKErOROImg95wQuVaofH-peE2-xsXfg&google_hm=zwMX6vXsxF8gu_JpaYNrxg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: t68qddkic579j7qvctd7alh4mila3h6k

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
190 B

56ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ-PSHfWxpO2lWwKlqquH_vdz4RmdsxEUH9hihW3xr6I-xO7it4XUnFTmArBm8lso1r2bTrEtvMjoX21j-_BvE3vMpCUBI

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ-PSHfWxpO2lWwKlqquH_vdz4RmdsxEUH9hihW3xr6I-xO7it4XUnFTmArBm8lso1r2bTrEtvMjoX21j-_BvE3vMpCUBI
Date: Sat, 10 Apr 2021 12:54:16 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBEQ1AtQS1NQ1lW&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058argL4VPa4XLfJtkjg1kRXRY4R

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBEQ1AtQS1NQ1lW&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058argL4VPa4XLfJtkjg1kRXRY4R

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBEQ1AtQS1NQ1lW&google_push=AQvitUK6WDFVPHaRQwjRegc3O1g35OA3BsirO3RrD9BH4lF4DP5D43tR-vqHVwyaJQb7At3Y058argL4VPa4XLfJtkjg1kRXRY4R
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULzagLjgJwMNcEJQXX5k4auD4W6KvS6N...

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULzagLjgJwMNcEJQXX5k4auD4W6KvS6NiXu7ZABpLfhJS-8hurCC4mZ5osjQQvEdhounc6c-ZGlCHRg_Hfs9x3v6ivXy-E

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULzagLjgJwMNcEJQXX5k4auD4W6KvS6NiXu7ZABpLfhJS-8hurCC4mZ5osjQQvEdhounc6c-ZGlCHRg_Hfs9x3v6ivXy-E
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 459
Expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 6F4E
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEPRx3oZTpq3VwzPQ71V9c9E&google_cver=1&google_push=AQvitUITZ_ztmibvhLwjTqLU...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUITZ_ztmibvhLwjTqLUTSRCTCtFxsArJAHpQ1gMt4tQbcobZ7P5gSiGLpzOKgEu0dWRGhUCVfkItcz0LjFKzcvLQZyyvRme&google_hm=

170 B
190 B

59ms
59ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUITZ_ztmibvhLwjTqLUTSRCTCtFxsArJAHpQ1gMt4tQbcobZ7P5gSiGLpzOKgEu0dWRGhUCVfkItcz0LjFKzcvLQZyyvRme&google_hm=

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AQvitUITZ_ztmibvhLwjTqLUTSRCTCtFxsArJAHpQ1gMt4tQbcobZ7P5gSiGLpzOKgEu0dWRGhUCVfkItcz0LjFKzcvLQZyyvRme&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Fri, 09 Apr 2021 12:54:17 GMT

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 6F4E 0
26 B 54ms
53ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JJaZ_8Ytrn-CopTHv1VQlRgLN0-5S17RILWXXX4HJSzun7_C1WbctlcuZXy0270ZVdHnCluQ

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/632480696839570921/ Frame 52CB 8 KB
8 KB 8ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/632480696839570921/downsize_200k_v1?w=400&h=209

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2dfbcb00dbb9b3e7b75b3c12dc6e6974e1469fdc43a2a6847c39483adec337b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 00:37:43 GMT
x-content-type-options: nosniff
age: 44194
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7856
x-xss-protection: 0
last-modified: Wed, 18 Dec 2019 19:40:54 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Apr 2022 00:37:43 GMT

GET
DATA 200
OK truncated
/ Frame 52CB 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-Q050 200 adview
googleads.g.doubleclick.net/pagead/ Frame 52CB 0
0 42ms
42ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C3eMt-J9xYM3dBo2wx_AP4JKiyALivLPPYNrxstmlDNjQj_O2DxABIJzW7wZglQKgAbmwpL4DyAEJqQJ0v_oZO_ezPqgDAcgDywSqBI4CT9AEq0UEIysTMF1zPEg0YvBvFZvnB2Ljb1vxr--O-UuI9HydrgQe102d9mkiPbd1jZY86_p1Cu-ivMcM2SGVQFq9q69htHAdJuOX3zHJtApes4a5o2H11h7ru-sAbvcu6ZcpFGaGbULQyVJeR1IRkl2HzY9wNPT_Do0hOxZRNKCSVslcZpu1Evnui8hrKzuMljMgoUYOfHLyGED9y0VXx2rWf48B_-uVYj0Y_V88CepMhjMXVNZKHPCtj1WIP_Call2ZP16XWlidvjMjJzPrrANpr3OR_ermcruJgKTEcxT6J3nI_f5AF16VNV8YGtVi5DJi962vDOWxPUaH-mkm7re0OJDTIXkebqgkeU16wASXpajnrgOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHr8_bQagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDFvyPSCAkIgOGAEBABGB-ACgHICwG4E4gn2BMNiBQBshcaChgIABIUcHViLTk4NzUzMTc1NTk2NjQ5MDA&sigh=bky8yTKuGg4&template_id=5000&tpd=AGWhJmtc6MA-r05jR0DX-NZN-vD-GSBz5bTqjUsPubWrmjh2dA

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 10 Apr 2021 12:54:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9536 42 B
89 B 41ms
40ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuDcF6PXGuAObIDR5HftNfP9mvtsjSFL4QsU2E3KpTtBBkiaXpkYm6GVMnTqr36uVDow5FTBTlFYbdFPIYha7-e0nQdwJHajWgSPw9e6dAL7VSvll1TYKZGFdOEUQ&sai=AMfl-YQ54sY0mf4RJrnuFM7bT_HseHwWmOgYRVctwuPzAhKnRjD37A--Bh3KU-xHTTU_oiw4tBVrFxIi86Sk&sig=Cg0ArKJSzKXMuOdK0bNKEAE&id=osdim&mcvt=1040&p=858,222,1058,1043&mtos=1040,1040,1040,1040,1040&tos=1040,0,0,0,0&v=20210409&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3479312165&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618059255569&dlt=300&rpt=55&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 117D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
156 B

15ms
14ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 10 Apr 2021 12:54:17 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 10-Apr-2021 13:54:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 10 Apr 2021 12:54:17 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame E4B1 35 B
210 B 11ms
9ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJy-_gy5n6FHX5reCacnRGQ&google_cver=1&google_push=AQvitUJqsQGp-AdCx-KuUt2ZbXZepf2ViP3PggHhNeUt9WEeWyrHEvEC8cGAwBw0OL028LDszXrjS75lrKG8QIlMCOUBs8P2h5HU

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6j...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFBUU9lSFg3QA&google_push=AQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6jnbWomVngkt5dUDPEo69wrwLoCBlcvwZXrJ6uunJTnt6zq4V_XvXLs3I-o

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFBUU9lSFg3QA&google_push=AQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6jnbWomVngkt5dUDPEo69wrwLoCBlcvwZXrJ6uunJTnt6zq4V_XvXLs3I-o

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUhHZkBRQUFBUU9lSFg3QA&google_push=AQvitUJsNXt_NeHohrvRWk7-ShwCXeMvAHPTFD_hE6jnbWomVngkt5dUDPEo69wrwLoCBlcvwZXrJ6uunJTnt6zq4V_XvXLs3I-o
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

170 B
190 B

56ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJZGFtL_RjTDRC9-lx_UA_WcfwsS0gXDSWAtqK-1BOCBoEHwi7vNveATwuIByDJXf7ic6Y4IUUxhbHRSB0L9Z0gP_T_1ymz&google_hm=zwMX6vXsxF8gu_JpaYNrxg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 47mbjf7ghhcts64t9i1k8htjphh5emfr

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ1Xe2d3l09Ki876RqD7BFpj-_nPwlX7wh0Jn2881Qi1fSXSb_sr9FwVt1CujSkX56NzbOzahAKfXS5ukQts63O3tL-IBTl

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUJ1Xe2d3l09Ki876RqD7BFpj-_nPwlX7wh0Jn2881Qi1fSXSb_sr9FwVt1CujSkX56NzbOzahAKfXS5ukQts63O3tL-IBTl
Date: Sat, 10 Apr 2021 12:54:16 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8h...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERFQtMy0yV0ZE&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8hr_Yu8aY4XEVYpSd2FKk2JFlw4

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERFQtMy0yV0ZE&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8hr_Yu8aY4XEVYpSd2FKk2JFlw4

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERFQtMy0yV0ZE&google_push=AQvitUKAROi90pWFXLlDodIKrxu9zm6DlChUsZVBWveP0feyTu71Z73-YOWvyZE7VaMaeMRQr8hr_Yu8aY4XEVYpSd2FKk2JFlw4
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULMtHhInsXFL4NWlwBYHyghmUTN4lNoN...

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULMtHhInsXFL4NWlwBYHyghmUTN4lNoNUEsJFxHJ0Tadh0soGxK_yAST_2BwitWMmR6kabC-nd8Gzwo2lUmwZPHrDgQnkgM

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitULMtHhInsXFL4NWlwBYHyghmUTN4lNoNUEsJFxHJ0Tadh0soGxK_yAST_2BwitWMmR6kabC-nd8Gzwo2lUmwZPHrDgQnkgM
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 460
Expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame E4B1
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEFxLJeSENIDUsnbE5XuUpbM&google_cver=1&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1S...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1SgjR00&google_hm=ChGgynZCSzecpxQE...

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1SgjR00&google_hm=ChGgynZCSzecpxQEfNkdZg

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUKstadC8j2-XfC7kaJLq7Z35IfCWBc7iDfQiTFsxOyAqel0aKEQyMSnAm0vtJ2UylN4zULBoi6lbYC6rR4M0TeJm1SgjR00&google_hm=ChGgynZCSzecpxQEfNkdZg
pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame E4B1 0
16 B 53ms
52ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IbtoopGjwu5iRqptXqXxrHx4ujapch7pwFblETECwDx7FK_NsUi2lqJPyWiPqWbXKMeYJk

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame A021 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7743
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 16C6 35 B
210 B 10ms
7ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJy-_gy5n6FHX5reCacnRGQ&google_cver=1&google_push=AQvitUJu2uJuRKxrOIgY7z99k1Lo-DlnFpzqU1QJbvtzfLvPuXOa673c8mcr5aE6Pmi38KLrlVWKu1_CgpGhS1xfLqdlGkAarvw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEF-AvcAFCsrbM-FLNeR12QI&google_cver=1&google_push=AQvitULISuk6rnCQN1xzOoPFZl-MLzYV-_TbIQSIEX_kjC92DSrOVedoF5WqPoZctxnYSOy-6c8Hu6tzHBN78rNxuMnkWM3zPtA
https://cm.g.doubleclick.net/pixel?google_nid=akneustar_dmp&google_cm&google_hm=Q0FFU0VGLUF2Y0FGQ3NyYk0tRkxOZVIxMlFJ

170 B
190 B

55ms
54ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=akneustar_dmp&google_cm&google_hm=Q0FFU0VGLUF2Y0FGQ3NyYk0tRkxOZVIxMlFJ

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:16 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=akneustar_dmp&google_cm&google_hm=Q0FFU0VGLUF2Y0FGQ3NyYk0tRkxOZVIxMlFJ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUKUTwrG...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAQvitUKUTwrG...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc5MjM3MTQ0NzY2MTY1MQ%3D%3D&google_push=AQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6M...

170 B
213 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc5MjM3MTQ0NzY2MTY1MQ%3D%3D&google_push=AQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6MAkC5Bf2tncUKleKpMJ9DAFZbEJC-A

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA0MTAxMjU0MTc5MjM3MTQ0NzY2MTY1MQ%3D%3D&google_push=AQvitUKUTwrGooOGtv7p4PN32TamKrFUhjdJB0RQKkO7dvF0nrkaSoPq-p61_DDGC_9r6MAkC5Bf2tncUKleKpMJ9DAFZbEJC-A
Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMgv9fODVQ0akwoHR7AgHarHkW3Ayv4Z4KF7Mr-dEWuY75z96QUObUs95tKRGfzQCwolV89y67QdfktJpwQFCJUZUHVoU&google_hm=zwMX6vXsxF8gu_JpaYNrxg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 3treqh1d3lb7njkoklnps7qpdu66jkj8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
190 B

56ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULU3R4aDzNIxhDC8DfjDzxINqED5CnEcEpEzO6qs9PKanBct3dWf8D8fOoagKAu15Ta0dlhp_iFB7uaFjllmxHzIJPF-Hc

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitULU3R4aDzNIxhDC8DfjDzxINqED5CnEcEpEzO6qs9PKanBct3dWf8D8fOoagKAu15Ta0dlhp_iFB7uaFjllmxHzIJPF-Hc
Date: Sat, 10 Apr 2021 12:54:16 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEY...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERTgtMjItMkJPUw==&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEYef8KZ5hbKw2fWNv1rUMWt7yk

170 B
190 B

57ms
56ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERTgtMjItMkJPUw==&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEYef8KZ5hbKw2fWNv1rUMWt7yk

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBERTgtMjItMkJPUw==&google_push=AQvitULbLYfjcijR5r07slMdFVNAwGgpAT99Vizr9zfMxH2RL0bJFy_bYygm4tlq8Q4V-VwVdEYef8KZ5hbKw2fWNv1rUMWt7yk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 16C6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_push=AQvitUJmqSD65H9P4XtO6PfGUzJD-VsxMJND6WVYim7WJ0qSn8fj-AwoL_FvtIdeCt_RVMmRZNvSzQfe1i1cxX7Rhn...

170 B
190 B

57ms
57ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_push=AQvitUJmqSD65H9P4XtO6PfGUzJD-VsxMJND6WVYim7WJ0qSn8fj-AwoL_FvtIdeCt_RVMmRZNvSzQfe1i1cxX7Rhn1B0WUF3w&google_cver=1&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY

Requested by

Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_push=AQvitUJmqSD65H9P4XtO6PfGUzJD-VsxMJND6WVYim7WJ0qSn8fj-AwoL_FvtIdeCt_RVMmRZNvSzQfe1i1cxX7Rhn1B0WUF3w&google_cver=1&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 458
Expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 16C6 0
16 B 55ms
52ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LYOxryecMV4jCHfuC6Fx6EmP5hVELGqoRlje_hfQ8Ah5XajEPc6NUJlEFkzo5XR1qQZkOg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 5fc4e06ba1f95115c0b98a08 Show response
cdn.bannerflow.com/bf-placements/ Frame 0624 5 KB
3 KB 62ms
39ms Script
application/javascript 2606:4700::6810:aebc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bannerflow.com/bf-placements/5fc4e06ba1f95115c0b98a08?targetwindow=_blank&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/6418128/1606738030413/DE_T3_Vaccine_Gold_Propsecting---320x50-637423348287122898-5fc4e06ba1f95115c0b98a08.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:aebc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6eb5400ce4aacc4576aacc93989a9740c1074188c479d8ceaa66bc60d4d11b09

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: JiHNdgj+mTPKE1sM7m25uA==
cf-request-id: 095d71fd88000064fd8412b000000001
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Thu, 01 Apr 2021 13:51:19 GMT
server: cloudflare
etag: W/"0x8D8F5153A8F419C"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 1e25e114-901e-0135-6afe-2629b3000000
cache-control: public,max-age=900
x-ms-version: 2014-02-14
cf-ray: 63dc1f75aee964fd-FRA
cf-bgj: minify

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 19CB 1 KB
755 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 09 Apr 2021 16:59:40 GMT
expires: Sat, 10 Apr 2021 16:59:40 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 71677
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CEE1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
21 B

15ms
15ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 10 Apr 2021 12:54:17 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 10-Apr-2021 13:54:17 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 10 Apr 2021 12:54:17 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 52CB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72c02c616884cc538c4756e6fefd2f1062073eb520a30787032cb37fa08abd9e

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7451 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=50&adk=3728675631&adf=3290653832&pi=t.aa~a.3910400141~rp.4&w=325&fwrn=4&fwrnh=100&lmt=1618058393&rafmt=1&to=qs&pwprc=1654914149&psa=0&format=325x50&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1618059256075&bpp=1&bdt=1252&idt=0&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0%2C821x280%2C327x250%2C325x100%2C325x50&nras=6&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1059&ady=2595&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=Qd5el7YZXu&p=https%3A//turkeyforfriends.com&dtd=33

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7743
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H3-Q050 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 52CB 21 KB
21 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 96640
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Sat, 09 Apr 2022 10:03:37 GMT

GET
H3-Q050 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 52CB 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 211875
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Fri, 08 Apr 2022 02:03:02 GMT

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame 22F5 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7743
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H2 200 render.min.js Show response
cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.24/ Frame 0624 28 KB
11 KB 141ms
44ms Script
application/javascript 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.24/render.min.js
Requested by: Host: cdn.bannerflow.com
URL: https://cdn.bannerflow.com/bf-placements/5fc4e06ba1f95115c0b98a08?targetwindow=_blank&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 465909b0130fad6ae6ed2b7911110808e5d1051484d4cee598d778046a85e8b0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:17 GMT
content-encoding: gzip
last-modified: Thu, 08 Oct 2020 15:00:18 GMT
server: NetDNA-cache/2.2
content-md5: nKJBh0GJujJ2zRZ0DYG9Tg==
etag: W/"0x8D86B9ADF280CFB"
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f9c2931d-101e-0081-178e-9d63e4000000
cache-control: public, max-age=31530000
x-ms-version: 2014-02-14
x-ms-lease-state: available

GET
H2 200 dpixel
cms.quantserve.com/ Frame 19CB 35 B
210 B 10ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJy-_gy5n6FHX5reCacnRGQ&google_cver=1&google_push=AQvitUKyge6lYSIP0v7N0FvyoIeRkxgcHjjl0BPXOEN5JnA6Nj87msmLfAKLOOx20P01cY-zKSZHPf2lYs3caQV4RKdHJKBirJc

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 19CB 43 B
324 B 151ms
56ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEB6N5nIikYs6T0hnISOWvQk&google_push=AQvitUJ7dpG9DzT5vJgLXZ3foK2t-newgIu0OSygxH7dcWMZp16dwslzsk03AIvrCeiH-ZzMRroCYdnyuN7etZ0qsFLKiongFiw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9875317559664900&output=html&h=280&adk=355153919&adf=1654560599&pi=t.aa~a.1567433689~i.8~rp.4&w=821&fwrn=4&fwrnh=100&lmt=1618058393&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1654914149&psa=0&ad_type=text_image&format=821x280&url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&flash=0&fwr=0&pra=3&rh=200&rw=821&rpe=1&resp_fmts=3&wgl=1&fa=27&dt=1618059256075&bpp=1&bdt=1251&idt=-M&shv=r20210406&cbv=r20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dae8ca22125bc516b-2280f28708bb007c%3AT%3D1618059255%3ART%3D1618059255%3AS%3DALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw&prev_fmts=821x200%2C821x200%2C0x0&nras=2&correlator=3359245479880&frm=20&pv=1&ga_vid=1142909979.1618059256&ga_sid=1618059256&ga_hid=363493099&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=222&ady=1275&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21067213%2C44740079%2C44739387&oid=3&psts=AGkb-H_9IG3le77Cab9clUIZXQN6Nvo6sf2eZFH_OtX0RxZd_HbphV2SzyrQ53m6U4sGggUl7SmoqLHb1MEKnQ&pvsid=2770646969613593&eae=0&fc=384&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=dAxl5ggyWb&p=https%3A//turkeyforfriends.com&dtd=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 19CB
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBb7OPzJPTha2gncFqHHI3c&google_cver=1&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

170 B
190 B

57ms
57ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE&google_hm=zwMX6vXsxF8gu_JpaYNrxg==

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:16 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AQvitUJMzpxyYLvtD_IyenYjOSI_rYKBfaHi0dIEC7SfAuKgnFLMN5NH8K5Zwe7YhBiKsne9-zU6mfLlCyMUATCMMWe9Ah5ZdWE&google_hm=zwMX6vXsxF8gu_JpaYNrxg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 9l8j08septa9e623dte0o1leiji7pjvd

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 19CB
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUKiW_I4C-KKVhqTKqDmoNFTLCdsDGC_K5gciLV84tZSPPtdhSaXnDXTzyt4nqW8iHi4bbw615O2PzRetIy4Y7gnB7yf3gNU

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0bAx8-dnRtCHoXShS6dc0Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUKiW_I4C-KKVhqTKqDmoNFTLCdsDGC_K5gciLV84tZSPPtdhSaXnDXTzyt4nqW8iHi4bbw615O2PzRetIy4Y7gnB7yf3gNU
Date: Sat, 10 Apr 2021 12:54:15 GMT
P3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 19CB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJv7AxQfqL7RR0ZyUNQIreI&google_cver=1&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBESjAtMy1FSDJY&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-KpCrti3HFnSJHFDCblqR23MQ

170 B
190 B

56ms
56ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBESjAtMy1FSDJY&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-KpCrti3HFnSJHFDCblqR23MQ

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S05CUVBESjAtMy1FSDJY&google_push=AQvitUIIhmscWyhYr8cw14mvinxQ4yT1JixGdFeoqdVDVIO5ZEQg8XnaxAedhuzblzW2MsjHF1-KpCrti3HFnSJHFDCblqR23MQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 19CB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUIJvdInWEsG5M7tia-950gEiKpSTsiL_...

170 B
190 B

55ms
55ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUIJvdInWEsG5M7tia-950gEiKpSTsiL_DROO_dX0VkxsnJm3zJEYVt9BHhzXHm3WcbwC7BqEmTdEnbPKoMwF9eBYooLijzx

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 10 Apr 2021 12:54:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YHGf-Hc1eMRIPt1bJWxakQAABKkAAAAB&google_gid=CAESEMlrYnnPwUe-Vq1j9QDZvDY&google_cver=1&google_push=AQvitUIJvdInWEsG5M7tia-950gEiKpSTsiL_DROO_dX0VkxsnJm3zJEYVt9BHhzXHm3WcbwC7BqEmTdEnbPKoMwF9eBYooLijzx
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 460
Expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 19CB
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEFxLJeSENIDUsnbE5XuUpbM&google_cver=1&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-l...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-lyUo4k&google_hm=ChGgynZCSzecpxQE...

170 B
190 B

57ms
57ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-lyUo4k&google_hm=ChGgynZCSzecpxQEfNkdZg

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AQvitUK8u4FL18k64wuYkGNYku91_fkdKJsalHlgA3w7LcLDe-McZYWyD253yFHyPoptfeuJU_sNGamTPyAGd08bW-frG-lyUo4k&google_hm=ChGgynZCSzecpxQEfNkdZg
pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 19CB 0
16 B 54ms
53ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KRs9CfnMlgpYh9pD6gckb6_HdVXTxyoKL82auPN6AES4umQcI7HVfZ52Q9Um6qBj0A1ENN

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 j
avsplow.com/a/ 2 B
341 B 163ms
55ms Other
text/plain 185.106.81.236
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://avsplow.com/a/j
Requested by: Host: st.avsplow.com
URL: https://st.avsplow.com/19.18.9/sp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.106.81.236 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://turkeyforfriends.com
date: Sat, 10 Apr 2021 12:54:17 GMT
access-control-allow-credentials: true
server: nginx
content-type: text/plain; charset=UTF-8
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT CAO"

GET
H2 200 tp.png
www.travelpayouts.com/powered_by/img/ 3 KB
3 KB 51ms
50ms Image
image/png 172.255.224.36
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.travelpayouts.com/powered_by/img/tp.png
Requested by: Host: turkeyforfriends.com
URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 172.255.224.36 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: f0ead86a3deaa703f6110cd46e3e88de322d811ae25f851d2ff9d8c158510c81

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
last-modified: Thu, 10 Dec 2020 06:20:54 GMT
server: nginx
accept-ranges: bytes
etag: "5fd1be46-b78"
content-length: 2936
content-type: image/png

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
6 KB 19ms
19ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210406&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12e07ecdc7739562812a35ea12d1145d38cd851017b32c47a64c0e81e8da37c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 10 Apr 2021 12:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6561
x-xss-protection: 0

POST
H/1.1 200
OK tracker
top-fwz1.mail.ru/ 43 B
1 KB 79ms
79ms Other
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/tracker?js=13;id=1204411;u=https%3A//turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789;st=1618059255794;s=1600*1200;vp=1600*1200;touch=0;hds=1;flash=;sid=d3aea82103ca1bc6;ver=60.3.0;tz=-120%2FEurope%2FBerlin;nt=0/0/1618059253938/////283/283/349/349/543/374/543/883/884/886/1856/1856/1857/3579/3584/;ni=10//4g/0/0/;lvid=1618059256188%3A1618059257524%3A2%3Adfb57ba7c001dbef21015a8303300fbb;_=0.19198630685588935;e=RT/load;et=1618059257523

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 10 Apr 2021 12:54:17 GMT
X-Content-Type-Options: nosniff
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Access-Control-Allow-Headers: *
AMP-Access-Control-Allow-Source-Origin: https://turkeyforfriends.com
Server: nginx
Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://turkeyforfriends.com
Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
Cache-Control: private, no-cache, no-store, max-age=0
Access-Control-Allow-Credentials: true
Accept-CH-Lifetime: 86400
Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory
Timing-Allow-Origin: https://turkeyforfriends.com
Keep-Alive: timeout=60

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame 261A 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7743
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Sat, 10 Apr 2021 12:54:17 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 7449 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://turkeyforfriends.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://turkeyforfriends.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Sat, 10 Apr 2021 12:54:00 GMT
expires: Sun, 10 Apr 2022 12:54:00 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 17
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html Show response
cmc-marke-cmc-markets.bannerflow.com/bf-banners/ Frame 494A 14 KB
5 KB 48ms
47ms Document
text/html 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html?cb=637528818793513813&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.24/render.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 2aa3b52565075d81aeddd52ee36c26f0752bb89819673dc2b1b6a01b7622df42

Request headers

:method: GET
:authority: cmc-marke-cmc-markets.bannerflow.com
:scheme: https
:path: /bf-banners/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html?cb=637528818793513813&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s0.2mdn.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

date: Sat, 10 Apr 2021 12:54:17 GMT
content-type: text/html
cache-control: public,max-age=900
content-md5: sXYnllecu7H0NCgVHjK1nA==
last-modified: Thu, 01 Apr 2021 13:51:19 GMT
etag: W/"0x8D8F5153A420CA5"
x-ms-request-id: 33d6c731-901e-013e-0d07-2e31c7000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
server: NetDNA-cache/2.2
x-cache: HIT
content-encoding: gzip

GET
H2 200 pixel Show response
560bd8d24d47fc28fc84259d.tracker.bannerflow.com/api/tr/v1/ Frame 0624 32 B
358 B 175ms
51ms XHR
image/gif 13.69.68.15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://560bd8d24d47fc28fc84259d.tracker.bannerflow.com/api/tr/v1/pixel?data=%7B%22u%22%3A%7B%22sr%22%3A%5B1600%2C1200%5D%2C%22tz%22%3A%22%2B0200%22%2C%22r%22%3A%22https%3A%2F%2Fturkeyforfriends.com%22%2C%22s%22%3A%221618059257679_60831%22%7D%2C%22a%22%3A%7B%22vs%22%3A%22v1.5.24%22%2C%22a%22%3A%22cmc-markets%22%2C%22br%22%3A%22560bd8d24d47fc28fc84259d%22%2C%22c%22%3A%225fbf6162a1f95115c0b7b415%22%2C%22ad%22%3A%225fbf69e1c4d26733f832db27%22%2C%22p%22%3A%225fc4e06ba1f95115c0b98a08%22%2C%22b%22%3A%225fbf69e1c4d26733f832db26%22%2C%22pl%22%3A1%2C%22r%22%3A0%2C%22an%22%3A1%2C%22s%22%3A%22573f02aa5fc38a2030ac9aae%22%2C%22t%22%3A%225fbf61bea1f95115c0b7b49f%22%2C%22l%22%3A%22560d02834d47fc28fc843770%22%2C%22bf%22%3A%225fbf69e1c4d26733f832db24%22%7D%2C%22e%22%3A%5B%7B%22d%22%3A1618059257679%2C%22t%22%3A1%2C%22v%22%3A%7B%22vw%22%3A1%2C%22s%22%3A0%7D%7D%5D%7D
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.24/render.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.69.68.15 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 853b983923a033223e4f391790e6e86619b31d542b40e7e1e8221fb0d6957ab1

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: https://s0.2mdn.net
date: Sat, 10 Apr 2021 12:54:16 GMT
cache-control: no-store, must-revalidate, no-cache
access-control-allow-credentials: true
server: Kestrel
content-type: image/gif
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3-Q050 200 71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7449 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/71hr94SUjmI4WsmVKl_xSF-LeUxrKTKLcbZwOLomvE8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 10:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 17:18:00 GMT
server: sffe
age: 7743
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5693
x-xss-protection: 0
expires: Sun, 10 Apr 2022 10:45:14 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9F3 0
46 B 42ms
41ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2Dbv-J9xYPy2B4HWgAfE4Jj4CwAAAAA4AeAEAg&bg=!GhmlGV3NAAY56aLOOek7ACkAdvg8Wq8-YZiJE0I45NK95OEcgbyT2s2UKdGJJKule5Uth1w4jfwbiAIAAAI5UgAAABJoAQcKAPEP-3JM24mtWKaxS4pQVU8HVBrUnxz48sEY4KIJNIVU0kZLcTi7ogwYo3rIVaeemSEDtp14AaOke1vXX9TXOCtTKPCT4Cm-u9HEbd7sSto8cl5l6uolkZha5VA0zXdb1QXA-XHUkWK7VBZxyFMImjqt4zF5eGkDzykNROWKNL-we0vJqTk3M6MD646rp4Dz59qJCw5PL5tYlx5tYcgoJCtbzUlTtMB2koUGZnJotcwdVdQzuac9xQUlBrgRBCjYuUKWAB1bEM9hQn8DO25VDIPEScGyosnzO5wh9tm7jbXmMmSfwUexYFnaGvygQWEuZXHumQKBLGXcy8r6kPOO27y5T6Lu-6VpD8hcwgCvuNCF_I_-yL68xJHF8fDhv9QV52PHunxZ_SwuXJHFqZQ76n0BMH1KgTTsQ4JuUaGZu3Q2kLnPvoiIcpQUaLTBuq7EE9qCAZOknqPyv7881xPXzhGRnkyyG8--_Zruy8Rpu3vjAZCiyRVJCQX6jYeyG1NuEnoZB5rYRIO8fk57n5AnjJMxHyrJM9QZS-OX2IRbO3CYZJsNJ-zzIw6zvm8WiEhF6-hZHwM2_FKS7DVCnQOzZecL5SSMYupHvMw7UGEr2JkdqgYKT8QuiIplxokSZ8lMBgitDCbXtZoCpLaeh88DtEEo7xAru5A_WDd-P0e7y64_awf-WinHkp1xId0gnt2wXuJIyH8OAUF3dpB_yHH7JvOcZMpl7jFX2nfmPR6NpZj1GKnLgSj2mwB-DGp4W-15rDYQy1QtZteU_kUyqMEfgDWjb1kzC4fJnQiKslsuHmPA65fZNL19Utpj-KRSXWLuaJWY2WD32yCHhx5H_LYhuDMlQqh1bCSB2Yo0ZYONtsUUvFm9qtct3Md6L87iNG74G1EPLjRouY3FVQ4rJqzQU1dWqQ_8GwiSk2lUSzT626SuV2YLcwPsoJgDCKVawB2vl7ffd09i9j6hXWlWumwquGMfg5KTUqHvrmZlZAWgVxCHwRMrEi1aTaSbIjrk4Q3N_pziRaQLVYiYBFHAftN_-j5Xww6s_IT-oQoUGQDOMl2MOEBfoLnXemSjTSJwCmsezjmngyc4wwVDy8ptQIPWZSoPC4tYukzBx575ATgBt1sooiuDZeboI7ToM34Ncqw57FAhiTi6sJgzoOzb931OwbUV0vBM_54

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5fbf69e1c4d26733f832db26.LbSW5z0SPizO.jpg
cmc-marke-cmc-markets.bannerflow.com/bf-images/ Frame 494A 4 KB
5 KB 46ms
45ms Image
image/jpeg 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-images/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.jpg?cb=637528818793087248
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html?cb=637528818793513813&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 0f81587ccc93a8918bb1208ead1ce43f5bb0a3e1c722010aef8e123318e04fec

Request headers

Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.LbSW5z0SPizO.html?cb=637528818793513813&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:17 GMT
content-md5: n7W6vI+W18TLRbR3y+0DLQ==
x-cache: HIT
content-length: 4569
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Thu, 01 Apr 2021 13:51:20 GMT
server: NetDNA-cache/2.2
etag: "0x8D8F5153B277E2C"
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 90de33ca-401e-0033-4408-2e989e000000
cache-control: public, max-age=900
x-ms-version: 2014-02-14
accept-ranges: bytes

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 43ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210406&jk=2770646969613593&bg=!RkWlRQHNAAY56aLOOek7ACkAdvg8Wp78fJVWr8NLCp4PnIVY3KiSoDAPIN5yHQI6O2XX4g5EW0mRxwIAAAB2UgAAAApoAQcKAU5szRSqTNKpmJBamn_PIj6xXgWOlH93p6OwlaLBM1Zz_axIXlsa84cnasX5VExXNtYO97EdDs_itHUzdYt5GcG8ma_tqPhQ6x_veGoh6PB8F2-QbLHw_H53yVHQMVTzNz4W6Cnu2ouuX8PP2JUEy4y5TjefvIhnK8RCVqlmIQrW_KhhvcdP9oQyt2a4rDmXgFkZzrYczhAL_WwYiKUQrThpHzywV5FhEjGHMwnhwbzyelVvYOip-0hEvX4zCymYmGRE2cVp_f5NfFmqbzscK71dH2iZ_ungpoBmEYQy8ahLjImgDxYYSXEf2pXRQLsVIWqFU0dJAsXGO6LaCxJ2him_TVg_O9jN6h6bCQPLBAuKW9beA6qs-QMPehaFDZ0tHuUGaUOKb6HtjUQMSo8Dfj57lzRrXDfIPlLzywRYxcErqDqjXN2dW-q-_Ifgud4qmQHXBfJq54GterVe182sE7hd9mG7fdD94TqM8Q_mGTBReW_rjOMQ_1SivtbXeCfYD6Gm1eCYWCYQgwF_BIjf5m7vocjuwdICu_fZQ0G9dIPRY6M4d4wTt4zGJd7nHMkeJVkzjdsn6DDeyMQWRjXedR4LRpdpMKLOqZFThH3h_6QkPW4gAqgpp4vYXKoDz2m6DOKlPAA924KNuu8yhrh8krfqVZlHVzV_gs33tucHKg9HFTOWYJCKrfRVsjJPhxcSzcIl1lo3zJa0WdEgs33wcy84m9RjniRjCQphsGAYqHAOQlKiP18QNw_VQl_f4xDiQAvDjWPmdzyGQaxu5HVQguEJA89Eeb8mccoywta9OnVlNXufK7ttC5-5AMDWER4bKMl0bj-axXmulB60ToJCFeveAQGe341p2U-nSX5XPVIMwGkTWVL_b489jKcG9VOMg-wnBQMqf4JsYuFW-RBVqJpM7h8P0iM9xsTdsjkUKM7MTITNEEj_macvKTjp2Q_bC1UnlZtfL3BDC4Be-rRzrNUtyDBIRVNx1SYT44ICvi8MvDfUBBe97xR0Zr7GsqocxGIKY5wmlgPKsDPnnSfiwNE58vWnovlJDsdRidG0nX9Jwin-VJ9DHZ8S

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-Q050 204 csi
csi.gstatic.com/ Frame C599 0
318 B 229ms
84ms Other
image/gif 2a00:1450:4003:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~knbqpcz0&c=6228825375471&slotId=3114412687735.5&qqid=CMzNvrnc8-8CFU1B4Aod5NQDIQ&umsem=0&ape=1&ple=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/b2ad9e2117aedd5ce941a2862458374c.js?tag=video_mra/web_raspberry
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4003:80c::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:18 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 4502077 Show response
mc.yandex.com/webvisor/ 43 B
73 B 196ms
54ms XHR
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/4502077?wmode=0&wv-part=1&wv-hit=1017741564&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&rn=932678452&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1618059259%3Aw%3A1600x1200%3Av%3A490%3Az%3A120%3Ai%3A202104010145418%3Au%3A1618059256274837472%3Avf%3A2qfickvpx9rcbpmn%3Awe%3A1%3Ati%3A2%3Ast%3A1618059259

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:18 GMT
last-modified: Sat, 10-Apr-2021 12:54:18 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:18 GMT

POST
H2 200 4502077 Show response
mc.yandex.com/webvisor/ 43 B
145 B 187ms
51ms XHR
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/4502077?wmode=0&wv-part=1&wv-hit=1017741564&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&rn=465158593&wv-type=5&browser-info=gdpr%3A14%3Aet%3A1618059259%3Aw%3A1600x1200%3Av%3A490%3Az%3A120%3Ai%3A202104010145418%3Au%3A1618059256274837472%3Avf%3A2qfickvpx9rcbpmn%3Awe%3A1%3Ati%3A2%3Ast%3A1618059259

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:18 GMT
last-modified: Sat, 10-Apr-2021 12:54:18 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:18 GMT

GET
H2 200 5fbf69e1c4d26733f832db26.html Show response
cmc-marke-cmc-markets.bannerflow.com/bf-banners/ Frame 55AE 47 KB
9 KB 50ms
49ms Document
text/html 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.24/render.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 241c68082258a3100d31a82f946b10901109926101739dec6e2be4febd95bd25

Request headers

:method: GET
:authority: cmc-marke-cmc-markets.bannerflow.com
:scheme: https
:path: /bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s0.2mdn.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

date: Sat, 10 Apr 2021 12:54:18 GMT
content-type: text/html
cache-control: public,max-age=900
content-md5: tclBOfuS57jPjbVECtqsFw==
last-modified: Thu, 01 Apr 2021 13:51:18 GMT
etag: W/"0x8D8F51539F7AFE3"
x-ms-request-id: e4b88934-501e-0086-4607-2e9561000000
x-ms-version: 2014-02-14
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
access-control-allow-origin: *
server: NetDNA-cache/2.2
x-cache: HIT
content-encoding: gzip

GET
H2 200 bf.min.js Show response
cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.19/ Frame 55AE 36 KB
14 KB 53ms
53ms Script
application/javascript 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/scripts/1.5.19/bf.min.js
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 8022cf718a91333368b5a25937dc874ddd460eebafc9c696413587d3e84276da

Request headers

Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-encoding: gzip
last-modified: Mon, 16 Mar 2020 15:05:38 GMT
server: NetDNA-cache/2.2
content-md5: QRHmaA+fGd/6nTs6zoKJfg==
etag: W/"0x8D7C9BB7CAAB84B"
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: de3cf490-101e-00a3-1b7d-1a0dd2000000
cache-control: public, max-age=31530000
x-ms-version: 2014-02-14
x-ms-lease-state: available

GET
H2 200 m-gold-09e59366-586f-4788-8a05-ee1d0d8d1024-58o64.png
cmc-marke-cmc-markets.bannerflow.com/resources/ Frame 55AE 5 KB
6 KB 48ms
47ms Image
image/png 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/resources/m-gold-09e59366-586f-4788-8a05-ee1d0d8d1024-58o64.png?v=637183203670000000
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 239712965b52273fcfcf6cf15da46f5953d597c4d1d5850a97aaf297457227e2

Request headers

Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-md5: xO+0FBjlEhCLpZlruOi/tg==
x-cache: HIT
content-length: 5498
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Wed, 26 Feb 2020 13:26:25 GMT
server: NetDNA-cache/2.2
etag: "0x8D7BABF7AA1C293"
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 262aa9da-601e-0109-1c04-2a9d68000000
cache-control: public,max-age=604800
x-ms-version: 2014-02-14
accept-ranges: bytes

GET
H2 200 cmc-markets-seeklogo-98449067-d698-43b2-a1c0-f9fb526aeb9f.svg
cmc-marke-cmc-markets.bannerflow.com/resources/ Frame 55AE 4 KB
2 KB 58ms
56ms Image
image/svg+xml 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/resources/cmc-markets-seeklogo-98449067-d698-43b2-a1c0-f9fb526aeb9f.svg?v=636715765470000000
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: f719913f971b804ca445ddcfb5974b9c88370bf739584198aa3d45098df89e9c

Request headers

Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-encoding: gzip
last-modified: Mon, 03 Sep 2018 13:02:27 GMT
server: NetDNA-cache/2.2
content-md5: 0/sXzgYc0NDLmYn59L9oGg==
etag: W/"0x8D6119D80157C89"
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 40e30409-501e-0005-0903-2a35cc000000
cache-control: public,max-age=604800
x-ms-version: 2014-02-14
x-ms-lease-state: available

GET
H2 200 modernera-regular-39e59ea0-8f65-4a42-b2c2-4cb0c5b98a5d-5099141930122455650-subset.woff
cmc-marke-cmc-markets.bannerflow.com/resources/ Frame 55AE 5 KB
5 KB 51ms
50ms Font
application/x-font-woff 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/resources/modernera-regular-39e59ea0-8f65-4a42-b2c2-4cb0c5b98a5d-5099141930122455650-subset.woff
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: b62c4c50d54cd117c07ec742b77bf8c3bbc39c6d0c053e2bcf461d2c70371875

Request headers

Origin: https://cmc-marke-cmc-markets.bannerflow.com
Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-md5: eM4lt6CI2O7o7W/6rxOOmg==
x-cache: HIT
content-length: 4912
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Thu, 26 Nov 2020 08:40:07 GMT
server: NetDNA-cache/2.2
etag: "0x8D891E6E0E01C17"
content-type: application/x-font-woff
access-control-allow-origin: *
x-ms-request-id: da80a3a8-d01e-001f-5206-2a1aa3000000
cache-control: public,max-age=604800
x-ms-version: 2014-02-14
accept-ranges: bytes

GET
H2 200 modernera-bold-56e89913-3b90-4516-a3ca-0694120fbdaa--8027340028462273893-subset.woff
cmc-marke-cmc-markets.bannerflow.com/resources/ Frame 55AE 4 KB
4 KB 54ms
53ms Font
application/x-font-woff 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/resources/modernera-bold-56e89913-3b90-4516-a3ca-0694120fbdaa--8027340028462273893-subset.woff
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 9462b42c81829d9ca9f9e5c84de32fca0d5f30f97e914b7f50dca931deac9c4f

Request headers

Origin: https://cmc-marke-cmc-markets.bannerflow.com
Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-md5: BDVN7P2bajq14ztINq1S9g==
x-cache: HIT
content-length: 3940
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Thu, 01 Apr 2021 13:51:18 GMT
server: NetDNA-cache/2.2
etag: "0x8D8F51539E13972"
content-type: application/x-font-woff
access-control-allow-origin: *
x-ms-request-id: 8c663c57-901e-011c-767e-2c5ff1000000
cache-control: public,max-age=604800
x-ms-version: 2014-02-14
accept-ranges: bytes

GET
H2 200 modernera-light-c2128457-e074-4cd9-bcab-c4151f0db593-4347192773032697727-subset.woff
cmc-marke-cmc-markets.bannerflow.com/resources/ Frame 55AE 3 KB
4 KB 56ms
55ms Font
application/x-font-woff 94.31.29.128
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cmc-marke-cmc-markets.bannerflow.com/resources/modernera-light-c2128457-e074-4cd9-bcab-c4151f0db593-4347192773032697727-subset.woff
Requested by: Host: cmc-marke-cmc-markets.bannerflow.com
URL: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.128 , United Kingdom, ASN33438 (HIGHWINDS2, US),
Reverse DNS: 94.31.29.128.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 56d4f36e98f459faa3a1f033928887fa549d1f47a737367a12234de244a85d46

Request headers

Origin: https://cmc-marke-cmc-markets.bannerflow.com
Referer: https://cmc-marke-cmc-markets.bannerflow.com/bf-banners/5fbf69e1c4d26733f832db26.html?cb=637528818788619581&clickpixel=%2F%2F560bd8d24d47fc28fc84259d.tracker.bannerflow.com%2Fapi%2Ftr%2Fclick%3Fdata%3D%257B%2522account%2522%253A%2522cmc-markets%2522%252C%2522brand%2522%253A%2522560bd8d24d47fc28fc84259d%2522%252C%2522placement%2522%253A%25225fc4e06ba1f95115c0b98a08%2522%252C%2522ad%2522%253A%25225fbf69e1c4d26733f832db27%2522%252C%2522bannerset%2522%253A%25225fbf6162a1f95115c0b7b415%2522%252C%2522banner%2522%253A%25225fbf69e1c4d26733f832db26%2522%252C%2522spotIndexes%2522%253A0%252C%2522bannerIds%2522%253A%25225fbf69e1c4d26733f832db26%2522%257D&targeturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsurqkHg4WhwNSeHEZuUtHLUGBXAvLOaEjYzT7jiha4a29aBVIb-Hvs7vKf70oA9PqA02ISj2hCXqmwmMUtEB97mSEW4I1He-lUemjHD_a6C3t1qWFE6mgKdxVZNVfJTkzKTlDIhY1sHIcxcbTMswaWbQ-o0g1VFKEodTgRGIErUfZeubjUR3BFZ_1inOtDzWolfwuGO8SAXGLWJHEJMbaRvkaP8rFL8HgwOJyXHW1dxqrP_Z4mmTVVtbgpRk8Oyf7yrwvJz2onYAnluIWiG59ISDQF1T-jI3txC-63Lj6DO7B4jIQzBfa7mjxw61pXUx2OGY18bOkpAFYaM9LsTtbSdR6DdadxE8zbC31N-VZk77skiHQTaWDCL8hD5GdBPA0-rPyM2O7B7H_WlafPBOIi5CcSNtC1DKBSuf684-NKMMfY5xj7MyF1vRYARpIlLViFOjSRlxlyyLovoHlYq7YauZLgZ0ymh4fdP65WsE2dwz8PXQC_XLCJlayYLGeBjRXclUlGZo_ZOQcX0-6_3AdFiSp6cJW_-vOBwbKhKKSxmbrJw_amSmD2fRhRp_TMHOPiIC5sipaYlJ78HjpMattzTWPF8IzJQZ2Ee2gCiiijXFtE6f3namFiCwYpqJUkjHq5Yc9o4ZQ_dINxdnCYN747WtWrphtFLcYG6rHig49FGa75OlLUqmCL2Cx0ufDWyxnu8KK8QaJHw4WYlEo96fMqGGOSnPHhvF8qYU1zUOZ81jCtYoYx7GYZu6gh9vfbjFhoOHw3iIM0Fy3yHtRlxgVlfu4hHTTmIeTBf4-MToPVR1gFHlPc3i3V9KKKhvFKuiooH0IAos9D5rKxZMIGCR9NwpU6-xYByujs__4-TPFrlVj4MilTuaFwkHb6kTQGJMF6PpAd7jECEEsIvBlND-OOb4MRSoXQJ_Brd1k8gWcpuc5jQijzkkt_gEY_v66LWmCYQSF-hZrJTL1-CvgzIT-GqkdFEaGWIh-gFm2NNl7L_5xUTpzgKgXsOlW0RLy7h3dV429n453nRoDYdK4AL-ILmbPxCzp32XrxcGL8L2ffKv2bVRaMc5JfF2rFz4QtmaVv9PNuX4L-5Tg%26sig%3DCg0ArKJSzEm2e8tKEmBeEAE%26urlfix%3D1%26rm_eid%3D4192616%26adurl%3Dhttps%253A%252F%252Fwww.cmcmarkets.com%252Fde-de%252Flp%252Fgold-cfd-trading%253Fdclid%253D%2525edclid!%2526utm_source%253Dgdn%2526utm_medium%253Ddisplay%2526utm_term%253Dprogrammatic%2526utm_campaign%253Dde-prospecting&targetwindow=_blank&ref=https%3A%2F%2Fturkeyforfriends.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 10 Apr 2021 12:54:18 GMT
content-md5: W72vv2aA8rd00Egl4k7PAg==
x-cache: HIT
content-length: 3500
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Wed, 27 Feb 2019 14:47:56 GMT
server: NetDNA-cache/2.2
etag: "0x8D69CC28FBEE1F9"
content-type: application/x-font-woff
access-control-allow-origin: *
x-ms-request-id: 4a84c06f-e01e-00f9-2422-2a0b53000000
cache-control: public,max-age=604800
x-ms-version: 2014-02-14
accept-ranges: bytes

POST
H2 200 4502077 Show response
mc.yandex.com/webvisor/ 43 B
145 B 48ms
48ms XHR
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/4502077?wmode=0&wv-part=2&wv-hit=1017741564&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&rn=19769563&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1618059261%3Aw%3A1600x1200%3Av%3A490%3Az%3A120%3Ai%3A202104010145420%3Au%3A1618059256274837472%3Avf%3A2qfickvpx9rcbpmn%3Awe%3A1%3Ati%3A2%3Ast%3A1618059261

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:20 GMT
last-modified: Sat, 10-Apr-2021 12:54:20 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:20 GMT

POST
H2 200 4502077 Show response
mc.yandex.com/webvisor/ 43 B
169 B 48ms
48ms XHR
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/4502077?wmode=0&wv-part=3&wv-hit=1017741564&page-url=https%3A%2F%2Fturkeyforfriends.com%2Fpubl%2Fotdykh%2Fturizm%2Finter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom%2F21-1-0-6789&rn=566394235&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1618059265%3Aw%3A1600x1200%3Av%3A490%3Az%3A120%3Ai%3A202104010145424%3Au%3A1618059256274837472%3Avf%3A2qfickvpx9rcbpmn%3Awe%3A1%3Ati%3A2%3Ast%3A1618059265

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://turkeyforfriends.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:24 GMT
last-modified: Sat, 10-Apr-2021 12:54:24 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://turkeyforfriends.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sat, 10-Apr-2021 12:54:24 GMT

GET
H2 200 dc_oe=ChMI_JK_udzz7wIVASvgCh1EMAa_EAEYACDk1upD;met=1;&timestamp=1618059266712;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 3A4A 42 B
498 B 169ms
76ms Image
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_JK_udzz7wIVASvgCh1EMAa_EAEYACDk1upD;met=1;&timestamp=1618059266712;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Apr 2021 12:54:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

397 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 17:27:40	Name: test_cookie Value: CheckForPermission
.turkeyforfriends.com/	1970-01-19 17:27:41	Name: _ym_visorc Value: w
.turkeyforfriends.com/	1970-01-20 01:27:10	Name: tmr_lvid Value: dfb57ba7c001dbef21015a8303300fbb
.turkeyforfriends.com/	1970-01-20 02:49:15	Name: __gads Value: ID=ae8ca22125bc516b-2280f28708bb007c:T=1618059255:RT=1618059255:S=ALNI_MbG4nNBdtUwR64bUzT0YrklhQnpGw
.turkeyforfriends.com/	1970-01-20 02:13:15	Name: _ym_d Value: 1618059256
.doubleclick.net/	1970-01-19 17:27:42	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 02:49:15	Name: IDE Value: AHWqTUlCYJiZYjbrMptmiUDJ3kOKpUccul5L5eDESB6Iq_U8bLY1Wp3KgjzhfNrvFMU
.turkeyforfriends.com/	1970-01-20 10:58:51	Name: _ga Value: GA1.2.1142909979.1618059256
.turkeyforfriends.com/	1970-01-20 01:27:10	Name: tmr_lvidTS Value: 1618059256188
.turkeyforfriends.com/	1970-01-20 02:13:15	Name: _ym_uid Value: 1618059256274837472
.turkeyforfriends.com/	1970-01-19 17:27:39	Name: _gat Value: 1
.turkeyforfriends.com/	1970-01-19 17:29:05	Name: _gid Value: GA1.2.390931232.1618059256
.turkeyforfriends.com/	1970-01-20 01:27:10	Name: tmr_reqNum Value: 2
.turkeyforfriends.com/	1970-01-20 02:13:15	Name: 0trforfriendsuzll Value: 1618059256
.turkeyforfriends.com/	1970-01-19 17:28:51	Name: _ym_isad Value: 2
.turkeyforfriends.com/	1970-01-20 02:13:15	Name: 0trforfriendspu Value: hRr4n3Fg

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789(Line 642) Message: uCoz.spam.handleDOM: done.
console-api	info	URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789(Line 654) Message: comments, goto page no comment id
console-api	log	URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789(Line 418) Message: ready - update details
console-api	log	URL: https://turkeyforfriends.com/publ/otdykh/turizm/inter_riehlti_tur_turizm_i_nedvizhimost_za_rubezhom/21-1-0-6789(Line 419) Message: scurrent 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

560bd8d24d47fc28fc84259d.tracker.bannerflow.com
ade.googlesyndication.com
adservice.google.com
adservice.google.de
ag.innovid.com
avsplow.com
c18.travelpayouts.com
cdn.bannerflow.com
cm.g.doubleclick.net
cmc-marke-cmc-markets.bannerflow.com
cms.quantserve.com
counter.yadro.ru
csi.gstatic.com
d.agkn.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
id.rlcdn.com
image6.pubmatic.com
mc.yandex.com
mc.yandex.ru
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
r4---sn-4g5edns7.gvt1.com
redirector.gvt1.com
rtb.openx.net
s0.2mdn.net
ssum-sec.casalemedia.com
st.avsplow.com
static.advcake.com
stats.g.doubleclick.net
sys000.uweb.ru
top-fwz1.mail.ru
tpc.googlesyndication.com
traff.travelata.ru
turkeyforfriends.com
ulogin.ru
www.authsmtp.interrealtytour.ru
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.gstatic.com
www.travelpayouts.com
13.69.68.15
142.250.185.194
142.250.185.66
148.251.128.101
172.217.16.130
172.217.23.98
172.255.224.36
178.248.232.202
18.194.113.221
184.30.20.241
185.106.81.236
185.64.189.115
193.109.246.214
217.69.133.145
2606:4700:20::ac43:44ed
2606:4700::6810:aebc
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:68::9
2a00:1450:4001:800::2001
2a00:1450:4001:801::200a
2a00:1450:4001:803::2003
2a00:1450:4001:803::200e
2a00:1450:4001:809::2006
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:827::2002
2a00:1450:4001:828::2002
2a00:1450:4001:82b::200e
2a00:1450:4003:80c::2003
2a00:1450:400c:c0b::9a
2a02:6b8::1:119
2a05:d01c:1d8:8101:ac20:41f1:bf24:9b3
34.246.227.69
34.98.67.61
35.227.252.103
35.244.174.68
54.149.211.134
69.173.144.139
77.78.104.3
79.137.69.120
88.212.201.210
91.231.186.44
94.31.29.128
95.163.118.168
014428424f68097441548d1f3fcbed2f1f1fd52327e49c01bdb9dce25eed3353
05a3f8587400860aa87bb18c9a9cd5b22a45ca4fc4a37a7922d29e48549b2fc9
0654553c4b28cec84bbab76ca705aa914a0d6a1ee2a260d672e19d015657b272
07b167891fe36ecbfb562e23e2c57a972afb0d22a1f7c1fce2176071bc1e68e3
0a0b459a26379ccd40bfd9ae5e02385abb0073eea2ae6f0fbc83c0792fafe08a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f81587ccc93a8918bb1208ead1ce43f5bb0a3e1c722010aef8e123318e04fec
1152be785978aa809034ab61de86ce4d03c5a301c95e96995e336d2462832a10
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12a84d53232f26ad8feb3dab55e480195520c092b9a8dc87baca96c7390d919b
12e07ecdc7739562812a35ea12d1145d38cd851017b32c47a64c0e81e8da37c5
13e444aa12f911443b6786d1cd5edf74f0488b0e466c183335ed1b1dbe91630e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a0a3e39dc26349f8fdd8e1b48581dd8657e24f9e04b2101928203d14360eba6
1b35f828bed609bd50d0004f302ae90810fcfdff55f4a1a50f7d801f590f2358
1c4f7c67d603a19e087a6a0ac87a53e6ba408407b0e9931936dd063eaf60406f
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1e7fb809061fcc36e119907fbc2d6a074f1490ba05f2dac809ee63e613763aba
22766bc9711d38912c8907394f87278de19fd42c4ac625b8883306bb93cd08bd
2307e8dc2cddbeb686cd3432dc412f8f1bfaca2f33c01e26f87f083645c0e7af
239712965b52273fcfcf6cf15da46f5953d597c4d1d5850a97aaf297457227e2
241c68082258a3100d31a82f946b10901109926101739dec6e2be4febd95bd25
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2594dd3b34fb2b3dbe53b3c52fb241284fbda363437c1d3610e18feb879465fb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
284ed3ce26c7a40eb6048708302382442a63c821b8fd407e6009c48fb3fccdcf
290f722475e26cf4eb3d2df8d8ece7304eeffb71660bd6ddb1d0c4a996c06b55
2952b9e57d2b46de9b4948d041b70e372084591f4760914788299e8509b27b9f
2a54fba5d9fa19b52f7a334a5caf15d15fc648aad383424b060e55d977cfcfde
2aa3b52565075d81aeddd52ee36c26f0752bb89819673dc2b1b6a01b7622df42
2b71b4053871ef753b0e8a283320bd43680c87d11f7dab5cd9b9ba8a745a1b8e
2c52e0a3468b3e72e9ec63a78394bfa483d81bbb2eaea9e54c58374735eea726
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e5157e22a908c379b53f6eb11cc56fcdfc408533728b3e7ecc0144ec636313c
2e783289cd2640b5cabdf71585e779325e293d11e420d1a5a70096b358fdc38d
2ef0cc81c995212f5e58167cffab64c44ee1456bbaa968357e74b4ff6512d839
2f7582f867dc787a49404bbc1d3d24e0744bbe334a437732f99c79d21d2cad85
33102e31bbad99c1969aa00d12e6cb01540aad74e5008eede7c5ec395b233263
33f79fd69ddb209232f3f1d431f46527406796680fd0b9b747ce227d2ad5c97c
351356b01316afb2c9f0c3e8d792162329519436a2858730065768defddf12e6
3a3d6f2ba38ebf419d15a9f5bebd4f4f82a8988dce549ce4ec973581078bb21b
3bdd5b93b198bc22083a4d09ec725118383db8b19ea0d7f29476abb27b43486d
420f362ee24fc2cd335decc4bce98708f6e3f357defd01df56aa413dcb106266
4219a39b6ff7a0b6606a0af20c38476a350b35c0b44aa5c4d1b77724ad3ef904
4274beb74e89b013f3373432b2f188c174111847d4886a34ee9144ff824c707b
4379d5f31e3f6afe959f9b9a7f92c2b482dbddff7f95a73abf78066dc7d7facc
4582dae9b2df6cf37f84f6c3b4ab00f39bea91d60f81c288e1a6f9e6b9486f36
460f1c7fc34d646086cbf555c52a2c8185370aa47fd969cffbfcede282e8049e
46348c08676290dcf101dc39ef729028003bfc8706f1c8af0fee030360513292
465909b0130fad6ae6ed2b7911110808e5d1051484d4cee598d778046a85e8b0
46fd206a3059094f068fa086639b6bcb2ce3362075d6311db23e618585e72556
47266f5d8118cec1898402204dbdfa8d5a2343b6ceec8c2036ea1d86552d519b
482482de4e30d44d002c2974ac86d777849d405250eef21933aca95ef89baf09
4854d668e624136dd7933baeeca9b0df8e97769dd2e3670575b19add70cfcbdf
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e0fd989ea582357754166789b3e0a896f231d21f237a6356671492f4b2bec8c
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54da198d7e02f27bf6741cb6892f2222c5768583b0876866ebd4d1717f09a7e3
56d4f36e98f459faa3a1f033928887fa549d1f47a737367a12234de244a85d46
5816948dee3208a60270bb2762dfd75701e628c4536004f02b4edddc0165c3fc
58895f95d011c00799124ce30f06c38ed4234885a669b69f62ea643e056fe2e5
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5acd5b0aefec349b8c705422b293122bb2e0e1bf77777463f565180e77ef2115
60120fdf580c67cffb3205987c4a22c928514ca185a3e3d6923be2f3cc934b68
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
6355f505a989a8737edcf9db74dff129c4b6ec44d99cf27aaee9cba4a56d458b
665ab0e00698d56e219a6574f67a09327e16ca80db3e33afd78dbe705f865f96
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
698a9a9ec926a15d254a8a7fa0c9523aa8e2884b349f3a061e2fcab3d9e27799
69d6fd46c1f56b952eb64c1d21c8da3f47fb8a5f5d66f0a568dafa3d1ebea6da
6a990434ac6098c71397d74d83fc6080048c9abbfb7d649d2ffb9ecc91fe70cd
6cd9a718f957858ebb3d9e68cb027ab035343ce49f1294ad570fa2ab33d30208
6e18ba4f01dc7dd94a5ca4d40da8cc0732221be22cd3ac2b79560e1a67ca61d1
6eb5400ce4aacc4576aacc93989a9740c1074188c479d8ceaa66bc60d4d11b09
6f005ef7cd0da757fba872c5832f3c2a52b928808764ff1e9823c53069b7538a
72b73c5ea4d054331853ea22776ecc5e7c65eecb24ca290f659037fd525f46d0
72c02c616884cc538c4756e6fefd2f1062073eb520a30787032cb37fa08abd9e
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
7360ab3a1e1fd97cdd1c6cb71e7ef02ee20cdcbad9a15875e3a8fe77def4e415
762a6837400425002737a0651c7764f71b279b18560cda75a140c1b8092f2342
789a93f4315357995e96053e32ee793d6b12f592fad617bb04f795c750f0c3bf
7a002a62e8254d9457a83cb9f9060a2d32f5f91ccd401efadb03ef65f41535e4
7b77bf52a193d42bdead2b71247e73e30577dc552b0bbbf732791388481d5472
7f35322549c2066c51df696a0f251672e04828dcee72af97667e24bc293c3a98
8022cf718a91333368b5a25937dc874ddd460eebafc9c696413587d3e84276da
82d9554002fbc6f25bb7f2ba93c3d74edf01603d21fade0240e39d3f7b1f3661
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
853b983923a033223e4f391790e6e86619b31d542b40e7e1e8221fb0d6957ab1
88d52e0262728e44a89739f8b5ebb1ee69e218f461f8f71e8fef906e7b189df8
8d9b4e8baf2d6296710fb142486efc074d1b4295512aa4125465410dbfd1053a
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
9462b42c81829d9ca9f9e5c84de32fca0d5f30f97e914b7f50dca931deac9c4f
953af01affd97621869fdb141a98da9fd0e2a1417ae0e3f27c0c3cd49032f5af
96ae2c4dd85b85004b0f54694c5d91eb909e92114f18d46273e0e6995be86444
97a78461a110f185b02d55e86b3d66a36eea60cfabbcc30fcda778c51ccfdce0
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9cf0f584767e187fce250df4a1aeaa01c0a89fa1dd4090c48bc064a8f05fdd1e
9ea613d68962c2b8fd9e265d0438642127824e6f7ed6b0de44aef7526708a964
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
a657a4d5d05c6cd9b9f881ab6941e71f725c7eb451c9f37ceb514e45fdfd441d
a9265d79c9ff74d4deeab5dce9643ed838018a6b4346605e002867858534f4bf
aa9c9d48f0700006b448dec420c57cb01870d2eb6391703fd5679dcff848c06c
abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340
ad7f82b6dfb74faddf961922b744ae095db97ea589cbe4a02c18129474428fff
addc630ee9eeebe2d1359bc48b22cec698a3fb19145fc0b8a125c82f90c3f9e4
ae54d6f9bc5c48d1df22581c7bcbf6dc657e54018127683781e59efca75e4c43
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b42518dc77c4945de01e0fa6c5cff76993018e34701d47c32d67ebaa1c246834
b46a9598ebcb8990e15425d7448d07588b574e313c7ff9430817141cefa5f887
b50775a86effc03381449c6753c834fe2ab4f4b85fdcd434b0063856612d2d03
b62c4c50d54cd117c07ec742b77bf8c3bbc39c6d0c053e2bcf461d2c70371875
b8f89f6286433e47ae35468f1fb5998670cea2323df60070bcbcea6a6ce24709
b934c49532e2ee20661596c4ca9cc57187a5597883946a96db119cf14db7c5f9
b990748ef3bf77ccebc3af529f80b05aa5c449a28ba150c9f1fd58cae99900a2
ba67a90c9bf9cd9687d20cec4501b29f881290f97021b4d7647b8463cfa4c8d7
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc9c46970b8459d26f30942a7b4a0a388e6d25b3501d0eadf0052c4015bcf360
bd5713e27f4481988d37b5b719dedea4e4379ec3c3bafea0fba9d0abe8db4973
bdbb3eb5659e27aff28f15ad2f3b094ff65027c2a0649278efd3927d1d9f1574
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
c2dfbcb00dbb9b3e7b75b3c12dc6e6974e1469fdc43a2a6847c39483adec337b
c3736a522ece00aeacddf66c21e54fc1b604b312922e2131d9e3f3e5532e7c30
c3a3c88ea0b781bd1ab252d80ed7324f7f124d4fa790dfc459db47abecd2bfa1
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c7f42fd7e961148cbacb3643b669d55768ded74e587cd30d429a4e8112c05a5c
c9581d69ef8a7435f061d76045cc929310f436366f9ced3b9b9811ca6ed26feb
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d39f2e864e1fd1b5dabe9fa196ea8a8faed786e76a1200efd17416160ee7f663
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d9be69c0d0fc0065dd03801ea9de774eca6b35a05f89dd44abe1df53605d89a1
dea12df9c0baca5e76f71f4e107a2f80fda56e09c76ddf86fe52e16b356f125c
df9ba466bcb8c9eee28c0ea55699ef4e7c15064bb7e1c0d5f0d5a3d2ea8bd7f4
e227608ddb22f360b351b383ab3c73a94c725157de44010717d95fbc29c1c42a
e2b941574b23214cc694eebfed8a949d4400d03c82b4383dcb3726c7c56934d4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e84568fe28f1653e662a7f9b2fb5246b12912d6659cda512f69795c5113f99
e674d825869b8d439df76b3a71d076999cf477dda5a54486af0a1f01879dcc32
eb3c3715d0a176f1982fb344bea13a6b61f63f8e3ec93a6786187eea39a53378
ed9aa2388d539ab7cd9a5ca03fa4d8df570c369de129b62a6b0b1aa926677225
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef586bf784948e62385ac9952a5ff1485f8b794c6b29328b71b67038ba26bc4f
f0ead86a3deaa703f6110cd46e3e88de322d811ae25f851d2ff9d8c158510c81
f190cb36d00f160e9280b48c1171f545af0497b47208c8e5afe5e677ae92bf4c
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f719913f971b804ca445ddcfb5974b9c88370bf739584198aa3d45098df89e9c
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
fc7a93f99efec36fadb3c7414915c246ab84b7e2a2bcea9e54d2d8be4a3a92bc
fdc38bc7cade8c519bc3232c11102cf4d582acf30282966a213ad17c2d3ac3ef

turkeyforfriends.com Open in urlscan Pro 193.109.246.214 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

261 Requests

100 %HTTPS

45 %IPv6

36 Domains

50 Subdomains

37 IPs

9 Countries

4398 kBTransfer

7159 kBSize

16 Cookies

8 Outgoing links

Page URL History

Redirected requests

261 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

turkeyforfriends.com Open in urlscan Pro
193.109.246.214 Public Scan

Screenshot
Live screenshot

Full Image

261
Requests

100 %
HTTPS

45 %
IPv6

36
Domains

50
Subdomains

37
IPs

9
Countries

4398 kB
Transfer

7159 kB
Size

16
Cookies

261 HTTP transactions
9 data transactions