credits-online.kz Open in urlscan Pro
185.251.90.186 Public Scan

Software

Resource Hash

96e61209b1c1fff1abe78fb763fbf093a04e6e992dc24b299ab1c4c5f4272f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:56 GMT
content-encoding: br
last-modified: Fri, 10 Sep 2021 15:33:58 GMT
etag: "61372b26-11d31"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 73009
expires: Sun, 12 Sep 2021 01:48:56 GMT

GET
H/1.1 200
OK pattern_slashes_10.png
credits-online.kz/wp-content/themes/brandon/images/ 124 B
461 B 247ms
56ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/pattern_slashes_10.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

596db9611f9c7de82c94b342f74cfd195587a186e583044ebda527407412642b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "7c-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 124

GET
H/1.1 200
OK ico_search.png
credits-online.kz/wp-content/themes/brandon/images/icons/addons/ 356 B
694 B 239ms
46ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/icons/addons/ico_search.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

30b30713e1148913998b2a41adcb68f317d1cd25fba1c7c841d0d1c87b100096

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "164-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 356

GET
H/1.1 200
OK pattern_form.png
credits-online.kz/wp-content/themes/brandon/images/ 2 KB
3 KB 148ms
48ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/pattern_form.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

aa6c7b6e2a933f2f87398282e215027f6d9c66643e11febe9f1c0983a639af02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "9a5-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 2469

GET
H/1.1 200
OK lato-regular.woff2
credits-online.kz/wp-content/themes/brandon/fonts/ 50 KB
51 KB 73ms
46ms Font
font/woff2 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://credits-online.kz/wp-content/themes/brandon/fonts/lato-regular.woff2

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

518e553370917289d130174596fd3c126d38f33b7c0f131a39832318ff1d584c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://credits-online.kz
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Referer: https://credits-online.kz/
Origin: https://credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "c8f4-5b7ae7d2cf307"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 51444

GET
H/1.1 200
OK arrow_bottom.png
credits-online.kz/wp-content/themes/brandon/images/ 167 B
505 B 129ms
51ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/arrow_bottom.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

db6b35773c412f0e212ca47c181c24df8578c987659f21d848d8e591e63c74c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "a7-5b7ae7d2dfca4"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 167

GET
H/1.1 200
OK ico_lang.png
credits-online.kz/wp-content/themes/brandon/images/icons/addons/ 935 B
1 KB 122ms
46ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/icons/addons/ico_lang.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

b749d98f6694af3bfb242342d54ad2bf66c32215f03caccb19f011283e111fec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "3a7-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 935

GET
H/1.1 200
OK ico_mail.png
credits-online.kz/wp-content/themes/brandon/images/icons/addons/ 852 B
1 KB 152ms
45ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/icons/addons/ico_mail.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

bc9da7c29c2f418f65426c9ee561fffa7f074654401113d1e6eb90c446c9a7a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "354-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 852

GET
H/1.1 200
OK pattern_slashes_3.png
credits-online.kz/wp-content/themes/brandon/images/ 124 B
461 B 69ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/pattern_slashes_3.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

5591b22a789bdbd179e4122d5e3046e172b976f9ec8635b2d06bc95ec36ab06a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "7c-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 124

GET
H/1.1 200
OK menu_shadow.png
credits-online.kz/wp-content/themes/brandon/images/ 138 B
476 B 128ms
51ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/menu_shadow.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

2647746c5f34a35a649bf0fc5caebeb0e62b979a28759570b868aabc02441ec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "8a-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 138

GET
H/1.1 200
OK header_shadow.png
credits-online.kz/wp-content/themes/brandon/images/ 134 B
471 B 114ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/header_shadow.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

6d9a7a0f51f762377327c3e06aa4a4823f491ca22bc2af639b27ad8bba49ca34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "86-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 134

GET
H/1.1 200
OK Cookie set /
credits-online.kz/ 36 KB
36 KB 1033ms
945ms Image
text/html 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Sep 2019 04:35:22 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; preload
Content-Type: text/html; charset=UTF-8
Set-Cookie: pvc_visits[0]=1631494135b238; expires=Mon, 13-Sep-2021 00:48:55 GMT; Max-Age=86399; path=/; secure; HttpOnly
Connection: Keep-Alive
X-Hyper-Cache: stop - no cache header
Keep-Alive: timeout=5, max=99
Content-Length: 50131

GET
H/1.1 200
OK ico__coins.png
credits-online.kz/wp-content/themes/brandon/images/ 562 B
900 B 140ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/ico__coins.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

84606a1e5b7fa01a825b57002ed6dd3a6b72f77a0efb0f0e8937fedd29137b88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "232-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 562

GET
H/1.1 200
OK ico__percent.png
credits-online.kz/wp-content/themes/brandon/images/ 488 B
826 B 159ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/ico__percent.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

d86fce1ca710228eb869846c4144d6d7f1681063f3418ad8e639753b2c7bb03f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "1e8-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 488

GET
H/1.1 200
OK ico__age.png
credits-online.kz/wp-content/themes/brandon/images/ 573 B
911 B 125ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/ico__age.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

702c11fa6fa551a3c6afd72cfa9bf291a4091a0ee85c8decb4222b166b507f26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "23d-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 573

GET
H/1.1 200
OK arrow-right_circle.svg
credits-online.kz/wp-content/themes/brandon/images/ 861 B
1 KB 138ms
44ms Image
image/svg+xml 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/arrow-right_circle.svg

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

c479e3fdf9f7899a4e505da12c3a8a6127860de7b639f60ee170f5b71fa3b88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "35d-5b7ae7d2dfca4"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 861

GET
H/1.1 200
OK pattern_slashes_6.png
credits-online.kz/wp-content/themes/brandon/images/ 124 B
461 B 44ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/pattern_slashes_6.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

0f430dfa497cbae001294f0de347e9fde2e4b329a5b1e4f38f9858138227366f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "7c-5b7ae7d2e2b84"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 124

GET
H/1.1 200
OK arrow_right.png
credits-online.kz/wp-content/themes/brandon/images/ 189 B
526 B 151ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/arrow_right.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

c8eff0f174533ef0c5fb2d83acce3413ac6d704543d961fe9d5e6074e6d59fee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "bd-5b7ae7d2dfca4"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 189

GET
H/1.1 200
OK inactive.svg
credits-online.kz/wp-content/plugins/kk-star-ratings/public/svg/ 223 B
564 B 45ms
45ms Image
image/svg+xml 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/plugins/kk-star-ratings/public/svg/inactive.svg

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

0d06a8516d69db767242f13cc35e99194cf0d263fd5221673ac5aef02723e3c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:52 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "df-5b7ae7cfa79a6"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 223

GET
H/1.1 200
OK selected.svg
credits-online.kz/wp-content/plugins/kk-star-ratings/public/svg/ 241 B
582 B 44ms
44ms Image
image/svg+xml 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/plugins/kk-star-ratings/public/svg/selected.svg

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

ff1306429d2b410360b1179c5d441febb39602e66f7fef56751cd26fa63b12b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:52 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "f1-5b7ae7cfa79a6"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 241

GET
H/1.1 200
OK divider.png
credits-online.kz/wp-content/themes/brandon/images/ 133 B
470 B 44ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/divider.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

54495314769d3d0480bfed3c41c38fcdf784be3e238c416f571ce38069c6736e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "85-5b7ae7d2e0c44"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 133

GET
H/1.1 200
OK back_to_top.png
credits-online.kz/wp-content/themes/brandon/css/skins/blue/images/ 2 KB
2 KB 44ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/css/skins/blue/images/back_to_top.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

f7a70c469d2229ad138fe4e9b5298efc84213431ace10fa7061de219091a8b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "75a-5b7ae7d2c3789"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=85
Content-Length: 1882

GET
H/1.1 200
OK back_to_top_arrow.png
credits-online.kz/wp-content/themes/brandon/images/ 117 B
454 B 44ms
44ms Image
image/png 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://credits-online.kz/wp-content/themes/brandon/images/back_to_top_arrow.png

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

a13e29cbf600ba737a947ac119ce64d37ad6f0321ff1a532d242224684c08ee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238; _ym_uid=1631407736760136349; _ym_d=1631407736
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "75-5b7ae7d2dfca4"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 117

GET
H/1.1 200
OK lato-bold.woff2
credits-online.kz/wp-content/themes/brandon/fonts/ 50 KB
51 KB 52ms
44ms Font
font/woff2 185.251.90.186
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://credits-online.kz/wp-content/themes/brandon/fonts/lato-bold.woff2

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

185.251.90.186 , Russian Federation, ASN35278 (SPRINTHOST, RU),

Reverse DNS

Software

Apache/2.4.41 (Ubuntu) /

Resource Hash

4652688bbab36c90a7eac1bbff09d885506f59b1082df5a91020975e356b2ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://credits-online.kz
Accept-Encoding: gzip, deflate, br
Host: credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://credits-online.kz/
Cookie: pvc_visits[0]=1631494135b238
Connection: keep-alive
Referer: https://credits-online.kz/
Origin: https://credits-online.kz
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:56 GMT
Last-Modified: Wed, 30 Dec 2020 13:28:55 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "c928-5b7ae7d2cc427"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 51496

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9393.iIZ9s3cTGMsHsoiWktWD_YeG33VlOkAEGQyJfOHwWAoluy7Fd51Jo54Yrbbths_A.6dtNil3sVLnHEnB3cLlmXTmWiF8%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9393.dNV9hT3kpQJ_snIvPIQP883qPD6haSi26FQxiVbmQ8hpGSc60OKosVBntsh0uSRccLPvRMKG6sysRwRJtYY7Hg%2C%2C.YkJrTFoPb6fpTGSTi65gNwxYzLA%2C

75 B
75 B

35ms
34ms

Image
text/html

77.88.21.119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9393.dNV9hT3kpQJ_snIvPIQP883qPD6haSi26FQxiVbmQ8hpGSc60OKosVBntsh0uSRccLPvRMKG6sysRwRJtYY7Hg%2C%2C.YkJrTFoPb6fpTGSTi65gNwxYzLA%2C

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.119 , Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:56 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9393.dNV9hT3kpQJ_snIvPIQP883qPD6haSi26FQxiVbmQ8hpGSc60OKosVBntsh0uSRccLPvRMKG6sysRwRJtYY7Hg%2C%2C.YkJrTFoPb6fpTGSTi65gNwxYzLA%2C
date: Sun, 12 Sep 2021 00:48:56 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
112 B 38ms
35ms Image
image/gif 77.88.21.119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.119 , Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:56 GMT
last-modified: Fri, 10 Sep 2021 15:33:58 GMT
etag: "61372b26-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 12 Sep 2021 01:48:56 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/70041580/
Redirect Chain

https://mc.yandex.com/watch/70041580?wmode=7&page-url=https%3A%2F%2Fcredits-online.kz%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A2661%3Afu%3A0%3Aen%3Autf-8%3A...
https://mc.yandex.com/watch/70041580/1?wmode=7&page-url=https%3A%2F%2Fcredits-online.kz%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A2661%3Afu%3A0%3Aen%3Autf-8%...

331 B
413 B

35ms
35ms

XHR
application/json

77.88.21.119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/70041580/1?wmode=7&page-url=https%3A%2F%2Fcredits-online.kz%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A2661%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1086717477603%3Ahid%3A763275975%3Az%3A0%3Ai%3A20210912004856%3Aet%3A1631407736%3Ac%3A1%3Arn%3A251030163%3Arqn%3A1%3Au%3A1631407736760136349%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631407733649%3Ads%3A15%2C95%2C965%2C89%2C831%2C0%2C%2C782%2C%2C%2C%2C%2C%3Adsn%3A16%2C94%2C965%2C88%2C832%2C0%2C%2C697%2C%2C%2C%2C%2C%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631407737%3At%3A%D0%9A%D1%80%D0%B5%D0%B4%D0%B8%D1%82%D1%8B%20%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B2%20%D0%9A%D0%B0%D0%B7%D0%B0%D1%85%D1%81%D1%82%D0%B0%D0%BD%D0%B5%20-%20%D0%92%D0%B7%D1%8F%D1%82%D1%8C%20%D0%9A%D1%80%D0%B5%D0%B4%D0%B8%D1%82%20%D0%BF%D0%BE%D0%B4%200%25%20%D0%B7%D0%B0%205%20%D0%BC%D0%B8%D0%BD%D1%83%D1%82%21

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.119 , Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

bedb118d5085c109cc0f5b29d47019aca37fa49ee1efc8d2e9bbd1acef588fec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 12-Sep-2021 00:48:56 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://credits-online.kz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 331
x-xss-protection: 1; mode=block
expires: Sun, 12-Sep-2021 00:48:56 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:56 GMT
last-modified: Sun, 12-Sep-2021 00:48:56 GMT
location: /watch/70041580/1?wmode=7&page-url=https%3A%2F%2Fcredits-online.kz%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A2661%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1086717477603%3Ahid%3A763275975%3Az%3A0%3Ai%3A20210912004856%3Aet%3A1631407736%3Ac%3A1%3Arn%3A251030163%3Arqn%3A1%3Au%3A1631407736760136349%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631407733649%3Ads%3A15%2C95%2C965%2C89%2C831%2C0%2C%2C782%2C%2C%2C%2C%2C%3Adsn%3A16%2C94%2C965%2C88%2C832%2C0%2C%2C697%2C%2C%2C%2C%2C%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631407737%3At%3A%D0%9A%D1%80%D0%B5%D0%B4%D0%B8%D1%82%D1%8B%20%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B2%20%D0%9A%D0%B0%D0%B7%D0%B0%D1%85%D1%81%D1%82%D0%B0%D0%BD%D0%B5%20-%20%D0%92%D0%B7%D1%8F%D1%82%D1%8C%20%D0%9A%D1%80%D0%B5%D0%B4%D0%B8%D1%82%20%D0%BF%D0%BE%D0%B4%200%25%20%D0%B7%D0%B0%205%20%D0%BC%D0%B8%D0%BD%D1%83%D1%82%21
strict-transport-security: max-age=31536000
access-control-allow-origin: https://credits-online.kz
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 12-Sep-2021 00:48:56 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 138 KB
49 KB 59ms
24ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/wp-content/cache/autoptimize/js/autoptimize_061dd95ede88079d9963acd56d72e1cd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0efc9707d95a85acadff05e56305f4bdda7fa2cdce2bea1177e85a61fc00eac0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49459
x-xss-protection: 0
server: cafe
etag: 1120673289430916385
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 12 Sep 2021 00:48:57 GMT

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/ 251 KB
93 KB 35ms
34ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cadedca735c6ec45885014e69884b741d9ef44349cd95c9271ae066216d49f6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95406
x-xss-protection: 0
server: cafe
etag: 12270461373536854434
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Sep 2021 00:48:57 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/ Frame 41AA 10 KB
5 KB 49ms
14ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210908/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 20:09:10 GMT
expires: Sat, 25 Sep 2021 20:09:10 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 16787
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 207 B
632 B 52ms
18ms Script
text/javascript 74.125.206.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=credits-online.kz&callback=_gfp_s_&client=ca-pub-9870499638323829

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f154.1e100.net

Software

cafe /

Resource Hash

6ce940fc75b3af4079e14454e464cb8f3b477b0eedc98d25adc5dc41e5617d4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 195
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 24ms
24ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcredits-online.kz%2F&tn=DIV&id=clearfy-cookie&cls=clearfy-cookie%20clearfy-cookie--bottom&ign=false&pw=1600&ph=1200&x=1575&y=1175

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 50ms
16ms Script
application/javascript 173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=credits-online.kz

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f157.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FB3C 124 KB
34 KB 587ms
572ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&adk=1812271804&adf=3025194257&lmt=1568090122&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcredits-online.kz%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737472&bpp=3&bdt=1912&idt=63&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6708965214129&frm=20&pv=2&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=76

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ace08a0f43a65cf643abdc60658c0ddc7f3aa72ebf2a1c95d278d4fa6d8387b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&adk=1812271804&adf=3025194257&lmt=1568090122&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcredits-online.kz%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737472&bpp=3&bdt=1912&idt=63&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6708965214129&frm=20&pv=2&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=76
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 35117
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 12-Sep-2021 01:03:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 12 Sep 2021 00:48:58 GMT
cache-control: private

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 38ms
22ms XHR
application/json 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210908&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

afbd3f22e28b5a82cd22086ef8a6ed6e96c567b08c8eab5394223704191054f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8551
x-xss-protection: 0

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 48ms
15ms Script
text/javascript 64.233.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74696de7db3cfc983f841facfdca75dbf4c114af467b05e23fe6d95694cab0fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273431406706"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27627
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:57 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EE1C 85 KB
27 KB 561ms
560ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&slotname=4842543231&adk=651642478&adf=2228029617&pi=t.ma~as.4842543231&w=1128&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&psa=0&format=1128x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737475&bpp=1&bdt=1916&idt=91&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=236&ady=510&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ZomMTNVRgx&p=https%3A//credits-online.kz&dtd=94

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a076234ae915ac063e52dd04e23fbb141f81859e77d4c4f2f54694c410c1420

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&slotname=4842543231&adk=651642478&adf=2228029617&pi=t.ma~as.4842543231&w=1128&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&psa=0&format=1128x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737475&bpp=1&bdt=1916&idt=91&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=236&ady=510&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ZomMTNVRgx&p=https%3A//credits-online.kz&dtd=94
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 28051
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 12-Sep-2021 01:03:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 12 Sep 2021 00:48:58 GMT
cache-control: private

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 68ms
21ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6467
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:57 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame C448 12 KB
5 KB 30ms
13ms Document
text/html 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Sun, 05 Sep 2021 04:49:57 GMT
expires: Mon, 05 Sep 2022 04:49:57 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 590340
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C030 783 B
1 KB 57ms
22ms Document
text/html 173.194.76.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f99.1e100.net

Software

GSE /

Resource Hash

fe3b1aa591c93ff10fe6af1887f2ca9c97cf8a41038c1a642d3aee9be4b3e46e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-whsLB6GFl8zVwB27lKwqqA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

expires: Sun, 12 Sep 2021 00:48:57 GMT
date: Sun, 12 Sep 2021 00:48:57 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-whsLB6GFl8zVwB27lKwqqA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame C448 35 KB
13 KB 20ms
20ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353359
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C030 0
0 40ms
40ms Image
text/html 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210908&jk=3372672236767567&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.5.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wg-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 23ms
23ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210908&jk=3372672236767567&bg=!-fql-r7NAAYT0U73E9E7ACkAdvg8Wn8lVJrmM0baJbU2PLCWzPTH2TlOyh_an9x0pVSYKetlNLDHjgIAAABPUgAAAAhoAQcKAIrWcYvTOIiTZ0ybPYjDaaMsW3riXORnEyCFX5hrh2QxcwprO2GCFrNU87WoPNLdkhSjpfyB2VEmff6lawvHFG39lG5Pced9SRtebiCQKm1x0S3xiX0HwJM0yj42504t_XZSp4fWxjV8DPs6XeENxioob1xqZQKTGVOis3EPgg-y-oL2C6ab7X9CSEeZAnNcB-mUr-aPa9Fx3H4fCdX3LS026VPEbJDg5dCqeaq-hf-YjI-TmXXrJpxXnSGWseBEEHQrBGUiy6-NfRYMbdjzDGP_EyTfATCZsEF5veGudAamk64VgAm9c6rkk8rmmqPedvdFfyC5kb-lkzQb7OLnUWEYvCgxwJHRrPd3lP5G3KSzVr2-6eUNhQ3jeCPYaFUbSJ7Mm73XZ672vGe-0ntmwisfGu2Kk_UKnsAwVxTHJ2BA2JOHBLap1EcZK4mI9mEYmN8EazhZD3HbPPwcbaUAsMiNfKQJemC9nkr0G4POQHMmJWgxAleIvDHWA3oNgc_qGYtaIJOunGW-1tp_ITlOIue4XVMNlZOI9f_f3yJaAB0h4YKkNf3gTR7L87brrPGY3FD7U-0ZKV7T8TCeD4iTmHijiQDRwUBwU5VEcN07lCVV7gXC2yxK6y2NwSW5xwhDjEt_K3LGhQmt8n9EXy5-3e5ucfIvhPj-xstnLOidtTeHAmOwPNkTlfM3ZvY32UwjaOW0wz3OmN2kd_G5XaytNfSuefRi5AgAMvweIjizt8IUIvlNfusQWnDgMT6xkf0g4wvcZxo01caMfln90DxOVI13DlmMEmF0nvyKqblp4ecydlI0uixYEYmQfDZ8_7QJrm0s1H0_XiFcyphl2NQjH2wc7h8pWMLyAQILwnICKqTKXJ2Fji6Ms97MzWvGGvQMHVXAVCRpDMcLLz5iVYbEsajByA6Z79ZdQDLcLPGpHzNUI2SvaE987zqr2SKfoFZsMGk_pieC0PMgGUbncSSNLFlxybHT2ZPlGywhHAI-fMl5VAJUqJBj8m3FbPVNsuACvFs

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EE1C 2 KB
998 B 52ms
18ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&slotname=4842543231&adk=651642478&adf=2228029617&pi=t.ma~as.4842543231&w=1128&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&psa=0&format=1128x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737475&bpp=1&bdt=1916&idt=91&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=236&ady=510&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ZomMTNVRgx&p=https%3A//credits-online.kz&dtd=94

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e2f43f6b7ddbd421caa2f283b114e810e158b5ed13d7fd35884b299303f3b464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 00:05:19 GMT
server: ESF
date: Sun, 12 Sep 2021 00:48:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame EE1C 1 KB
857 B 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29814
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:04 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame EE1C 18 KB
7 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame EE1C 2 KB
1 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 10:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50198
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 10:52:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EE1C 125 KB
38 KB 44ms
22ms Script
text/javascript 64.233.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38649
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame EE1C 14 KB
6 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H2 200 8b8c639f95e935c054a6465040a495ee.js Show response
www.gstatic.com/mysidia/ Frame EE1C 26 KB
11 KB 50ms
13ms Script
text/javascript 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8b8c639f95e935c054a6465040a495ee.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42dc9aece188c290c3303813e9f91c1d596f1267899f3b3357280be43c16ab53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 03:06:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10883
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 00:31:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 09 Dec 2021 03:06:39 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/1107625502540285939/ Frame EE1C 39 KB
39 KB 35ms
35ms Image
image/jpeg 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1107625502540285939/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85853c38f0c7f61d940d387d91f4539923c5494f7e0a6189bfbf4d176853723e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 39557
x-xss-protection: 0
last-modified: Mon, 19 Jul 2021 16:41:13 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 Sep 2022 00:48:58 GMT

GET
DATA 200
OK truncated
/ Frame EE1C 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame EE1C 0
0 22ms
21ms Fetch
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaWEEeU49YeyJJM-i-gauqpWgAsGluudklPTltvEN3NkeEAEg9bT1HWDJBqAB6q71vQLIAQmoAwHIA8sEqgS7AU_QCa5PUII55D6PB0D0HI93Hoaja8e7VDyqmnkzXMD1GxP6wgpOnh5KuL-h-jAAjtcW7FC4AVksqd7epjnRlHIotjctinYnkai2Jitsw0bWob7elkkTaXHolQYr0OxfYdOIJQeoru5lCFjUAxmXK7hZOtsi82Y2aP-zHT0248CbSaOpPJd2U9jmzW-f_elsDNGXXpIYG0SnWqk1-CAJ_yBRyqKZ-RyHweowmx8hT-y5Is4RceIM-ZVPTWbABLGnqonXA5IFBAgEGAGSBQQIBRgEoAYugAf-0IrCAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQnKcB0ggHCIBhEAEYH4AKAcgLAbgTiCfYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItOTg3MDQ5OTYzODMyMzgyORgA&sigh=ffYdLY6oCiI&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&slotname=4842543231&adk=651642478&adf=2228029617&pi=t.ma~as.4842543231&w=1128&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&psa=0&format=1128x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407737475&bpp=1&bdt=1916&idt=91&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=236&ady=510&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ZomMTNVRgx&p=https%3A//credits-online.kz&dtd=94
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/ 145 KB
52 KB 33ms
32ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/reactive_library_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb668f5b914a3a51619e1d07d4ed7b0562992306736c78834478292740ddbd68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53094
x-xss-protection: 0
server: cafe
etag: 3023641859606465074
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 23ms
22ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=2&c=ca-pub-9870499638323829

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 22ms
21ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=7&wpc=ca-pub-9870499638323829&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=true&a=6%2C1%2C5%2C7&apv=20210908_110605&sat=1631312748186&afm=0&as_count=1&d_count=0&ng_count=0&am_count=7&atf_count=1&mdns=0.044&alldns=0.293&allp=63&fd=(0%2C14%2C10)%2C(2%2C6%2C6)&pgh=6351&su=credits-online.kz&pvc=3372672236767567&r=0.1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 44ms
16ms Script
application/javascript 173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=credits-online.kz

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f157.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 767E 436 B
233 B 369ms
368ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=3056760716&adf=925569850&pi=t.aa~a.1025862210~i.2~rp.4&w=1136&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1136x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1136&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280&nras=2&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=232&ady=3302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=T4HsELOa09&p=https%3A//credits-online.kz&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f48a0a326e35341b67b59145fbfefd80bc213071fc8769875e77c60843ac2c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=3056760716&adf=925569850&pi=t.aa~a.1025862210~i.2~rp.4&w=1136&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1136x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1136&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280&nras=2&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=232&ady=3302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=T4HsELOa09&p=https%3A//credits-online.kz&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 213
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4789 68 KB
21 KB 384ms
384ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7658864afdc2dee57c17087f6ea9ccae4d663cabb118863e259008f8179059b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 21557
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7EC2 68 KB
21 KB 572ms
571ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b9e425627fa395a02eaa89c0cbc540a123425104750d714217331011aa5a910b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 21445
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6B81 68 KB
21 KB 358ms
357ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfa08470750cf8ac8ebf5cf03a6fab5f519462691157a323c7b55fc7a178ba85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 21520
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 91A8 436 B
233 B 393ms
392ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=3289410193&adf=1372177128&pi=t.aa~a.4174451947~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280&nras=6&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=1210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=AKgwbWPD1z&p=https%3A//credits-online.kz&dtd=26

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92aeea1d69a42b701d942650c277dfc4c0484d3fca4a45ca365682fcfc8b1750

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=3289410193&adf=1372177128&pi=t.aa~a.4174451947~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280&nras=6&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=1210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=AKgwbWPD1z&p=https%3A//credits-online.kz&dtd=26
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 213
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 27A0 18 KB
9 KB 577ms
577ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

123df0def643b6afbf524365470f3bc53bb9feccb9b79ec8b70a8d820998f520

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
content-length: 9210
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame EE1C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75caccbfaad578b6585750bb32a597b11b7cd7076982b790fa844ff43ccf94cf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame EE1C 21 KB
21 KB 49ms
14ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 20:15:06 GMT
x-content-type-options: nosniff
age: 275632
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Sep 2022 20:15:06 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 22ms
21ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=2&c=ca-pub-9870499638323829

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/ Frame 9223 10 KB
5 KB 14ms
14ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109080101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://credits-online.kz/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://credits-online.kz/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 21:06:30 GMT
expires: Sat, 25 Sep 2021 21:06:30 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 13348
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 531D 35 KB
13 KB 20ms
20ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353360
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 9223 18 KB
7 KB 14ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:01 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 9223 2 KB
1 KB 14ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 10:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50198
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 10:52:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9223 125 KB
38 KB 22ms
21ms Script
text/javascript 64.233.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38649
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 9223 14 KB
6 KB 14ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 9223 26 KB
11 KB 15ms
14ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

331c8dbc087f677d4eca8035d19626c0662a712b95d0d78bbeba05b7c3bbe7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 05:31:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10845
x-xss-protection: 0
server: cafe
etag: 14737611871312058204
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 05:31:58 GMT

GET
H3 200 923282282625581180
tpc.googlesyndication.com/simgad/ Frame 9223 20 KB
20 KB 148ms
147ms Image
image/png 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/923282282625581180?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlQuH8RFnpe6EDSxfE4HAxPOib1EQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

730f47607e0e52a0537cdd4574b90ae4c53731512f313fba41c814416b4d9ea5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 2020 22:18:19 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 20046
x-xss-protection: 0
expires: Mon, 12 Sep 2022 00:48:58 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A350 143 B
163 B 14ms
13ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 12 Sep 2021 00:36:19 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 759
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A350
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 12 Sep 2021 00:48:58 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 12-Sep-2021 01:48:58 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 12 Sep 2021 00:48:58 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 12 Sep 2021 00:48:58 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F3C 35 KB
13 KB 20ms
20ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353360
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 6B81 18 KB
7 KB 15ms
15ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6B81 8 KB
713 B 37ms
18ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 11 Sep 2021 23:47:52 GMT
server: ESF
date: Sun, 12 Sep 2021 00:48:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 6B81 14 KB
3 KB 36ms
14ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 6B81 357 KB
124 KB 66ms
46ms Script
text/javascript 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aebcd38397f33a5e7c8d39dd1dcb0eb19618cd23cd430a535c9e8666542c815

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126725
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 6B81 14 KB
6 KB 16ms
16ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6B81 0
0 19ms
19ms Image
text/html 173.194.76.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSnR8W-VZdA2Uf05KTkgw8n_ppF7PdEhR5rBUhEOfb3_GN8OzCFMm2cl6p_Vi8ZqMhyZrRAgLpETIYY-6WUlFEBazkujw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 173.194.76.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ws-in-f99.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 4789 18 KB
7 KB 18ms
17ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4789 8 KB
713 B 36ms
19ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 11 Sep 2021 23:53:22 GMT
server: ESF
date: Sun, 12 Sep 2021 00:48:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 4789 14 KB
3 KB 33ms
14ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 4789 357 KB
124 KB 35ms
16ms Script
text/javascript 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aebcd38397f33a5e7c8d39dd1dcb0eb19618cd23cd430a535c9e8666542c815

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126725
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4789 14 KB
6 KB 17ms
17ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4789 0
0 17ms
17ms Image
text/html 173.194.76.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQwbebHa5t6KVlzqJObuLFzf0E-mIUJppbali1wQrE6phiVIB2KAFKsMi5bCClXc2lp-tRKbYUHgJSMPeQs8EIMbo3I1w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 173.194.76.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ws-in-f99.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ Frame 4789 0
339 B 381ms
126ms Ping
image/gif 173.194.205.120
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ktgi1nk7&c=4262088968268&slotId=2131044484134&qqid=CPyC5bWb-PICFVIc4Aod75oCwQ&fb=outstream-lima&sei=44724516%2C44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.205.120 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qm-in-f120.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 4789 9 KB
9 KB 55ms
23ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:05:04 GMT
x-content-type-options: nosniff
age: 495834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:11:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 07:05:04 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 4789 15 KB
15 KB 69ms
38ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 08:39:14 GMT
x-content-type-options: nosniff
age: 58184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Sep 2022 08:39:14 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4789 0
20 B 30ms
30ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CO7mfek49YfzdENK4gAfvtYqIDNDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9DsqCWifj8w_J862un6mINWukHyw6m0mvOI2h32EA82nROtJau98amNH2nSmxaRxRDrM1mLuiVUfRZNGmuLOhPKCUhN7CrWHZAxdVf52vQeYmAZ_UjIGBy9WVsX-2xIO4xu9GQ8fGPPQh2pCnkV9SZ1fjiw-rhv_vK9Dl0K_CjX4uYh0Z4UBOwVy66CImYnxKHjEzELZ9qYSypky0baywcNvaQxp3sSh5ROWyGgSm2Jt0WOG7GDHFbouQHsZy_mOeA7TgC4G7vmXOG_xrDDisAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ&eventType=clickstring&clientTime=1631407738767&ai=CO7mfek49YfzdENK4gAfvtYqIDNDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9DsqCWifj8w_J862un6mINWukHyw6m0mvOI2h32EA82nROtJau98amNH2nSmxaRxRDrM1mLuiVUfRZNGmuLOhPKCUhN7CrWHZAxdVf52vQeYmAZ_UjIGBy9WVsX-2xIO4xu9GQ8fGPPQh2pCnkV9SZ1fjiw-rhv_vK9Dl0K_CjX4uYh0Z4UBOwVy66CImYnxKHjEzELZ9qYSypky0baywcNvaQxp3sSh5ROWyGgSm2Jt0WOG7GDHFbouQHsZy_mOeA7TgC4G7vmXOG_xrDDisAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 4789 27 KB
13 KB 68ms
46ms XHR
text/xml 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-DPjX_epJ9wIO_LbLp04tW12LVqaIfzPeJ5yH1OZ0E6dUYEfoVg_JRjuTh9Pw6sLUp5y2rJGtMtgS2WFoJyNexoY3j4Tg&cry=1&dbm_d=AKAmf-BSi43ovl5HvCMNCHupLd9L1wfHb_0dWBbYculbo_hqya9_OfGcNwEgGXFF7qnXkCqd-8bp8eeFgqSUY5Rg3RpZXE5WYrY57CtXlI9PyvaX5j92CLem95kQLEG3QGa14cQJIRCb7660_sE7w0S1UxO30vhlu32Orl9gt6fQlbXSqUeL6PuYJKrYZsISyTjFMPAByRveL9_ZlSocpBsVxoSpX6KOaBYb-t8LjAG77V_E9N6qzVxAwZbYS5rRkSlxLF1Kvrz89nCa_2DwwwJ4ycZcTv7YTWEpE5aZa86kHZF6nOeYsMCUGWGGkm1Qlgxn5y_gOesL5-ZpEQdAWKJsv1vqgdFHloLWnaydpwbM-9IWrzF1ZVELXXaHKx9FF3rCfyLjoVvSDXfUeBn3kHdtJS-u7HC61nXPzekaNKg_dp7rOXIIGnbl5ronjyrYZcQD5eLeejKByvXdzFB_aQXgqF2worypeNswiRNnMVDREBDg7RgAzF0vuuoV_KZuXmLSWOU3ceHWavB0kz7B_ygX0EDKxPWocvvXybuCxqBHrpq6TC6BHVNJkzI5szhjrG_mOUxmX5xN79-d-pgp2HdTm54P2SWCZXuM8KuIHNwihQUXYoVLEDmxDdlEKF8e3bkFDsTcqLsAow6mHLahpHqnQHiZNZJAdJYOgI9nUpg0EgVcSlEgCOUIu-XBc8a5EYPWBS3pAMo54jsNJgjkqJlpsQpdQczBL7b_ETiW48PUMwZKk3O4h8feFdtvs6_HLUMahqcsNR4J6ysUv6p-2dNC-W5E-W_h6MwoLgmLtS9BpnK4DdQVOoeAawYVw8yfKifN2J4JAUK6JP_y2I7cIX43Pt4l911aSMVdriHKNzyWh1_ko8VnbDMHoekhE4xAQX-TZRr4H713NaaqQnaflU57HvrlSW-FNC8uYveq0yihVGvPYRtsNp_N1Qd5BVHOsInNDKODeNTy6PvdjamjYEc9UVp0ep-45iI6TMmEhsF8EUmVrXCX4E7Szm7UKw6BYn21ojSM7fIESymMm3ZZqfvNy3kO3ZFt616qMgklQ4Keq8Qii2r3mJvyRG7lSOI1Y8BnY0kYh-atjqj9jkqXf0ivBmqT6w-gqeW4IaM1EoI0PDNhO5zw9DYSiJj8WSXuqff42hm8SywMJVWKFmAFhGu0DJi9mg92z22UYYAjwVJvhWyiWhiYTEKMe-lpsmOMcg5v0nwf3Nf6iq_M6gqM52ASe7mEGuWYaVFxWdV_ZVavksnNxYPOPXvm3uVCsdqyNl5FAMekwD_IEUhP8i6McOTXJYKvjNYcHZ510-2IK9iD5LrDiu0dRCfwu7auvX0zzYQdNLiKI9CNTXbkOwiH6nZ3cbsBEnwMaK7wKrMI22qPV3GW7vdRGXZNXykvqxK9sIcG-uGVHBfjsCT2HnkVW44IbJr2eS36Rk8726c5sWMXsneLJT6F88jRqZmUF0AK6WmuK25GKwQMgsKlj2Z0mEQ9Rg3wAYTfs3c6cAEf4gvWENKJo7gJ3RNTTaqlEqb-YnYyJyrk3ZDDoL7ZnQtVsHDTLlZTAaL9fhxD95lp-OtnHmSCcM9LkJ-Q_HHw7W_2Vf4CIchSg5NvtfD5XhUFAdEMcy46Il-5IVmYaMzZbvz-D98faElwHv5YKhnJwOCdNfHSJKsvf4zTeN8va6AAXQ_dG6dSEzS8DvpcApSdOefz-Vpx-axwTbbWSMYUpTFt0fdAwYonePnRN7DPODDF-a56uUXmEBeyfH2LgohxcQEjhmNhXYoGlNeRAHfvmnh6kNrMEp-a1jtokLgi0EB5Xv3BJWoIFcmeQTiRIszcjrzw12Fr6GW8qfBZ0QTmDJoC0FDfJhsPTsaNnRIjxmYmvJ5m8KcA9QocM274u1LaLMtSuQKpQ463N6lSwb86mnDJx51HJBHE-ewp5O-uy96a8KIua73MoAY60_Nqpb76EeqnYxgDHrHHgc6ctZGrZTQhtkRFvkYU-FBqKYf2UM7ZEFOVPYvuWh-9RJ9f6GloD6j1AkH33EQ_bD63SJzfrKsgRP0u7ApiK_Id3ksnn_y1qil2TgmDhBmTNq2SbxzRUT6y-qdxAWDQtldvdhrXQdXCp0sku523Z9HhZHKAUT3YIqxVkrhAb6vEiar--5y3_4sJALzVe9n-TQdx_Yiy_QW1uHHTMEQ-J4p8Le8sNn1eUa78JGU9QZT2XJpxdcYj0ASzETSNf1jdq6SSfJnq1KFO5ga8cacAo--bGcB9OQlc92f9r8d3VkPEDf_2MqzlEidEjLzX75-E3Yu-pqO6aeKGkdizB-gJ7XRLid4zUd-G-VlEhJ4l1XjzVpGPClms785natnu4kUcyQwNO3r32Ag41ri0LrU7j34T4xO68GIy2yvutxtILU7e7U8_xuUYPOX0zIkUEMOtillKXjKyGzJzhSQxUs3Q_90FF5Lo8nnA6SrfT0mlE2iE6_YdXh7pvLF_4duzbGJS3FVH4AovZPhdqEs_JMSqZU5icbEmzhh9p0_e7I9D8ifj6Oa9fPl-K8XWoi0MMq0P6cWTWMBoqIkR1L5OD5nv9dW0IyZBLwxYa9KbOCWz-NUVRiecQg00xWKmuOTMYho085V9AgjStwxSV3w7ywHm7L5-w0JeVYTRtlJB7bNNK_yMmk7jzLxFfVPF2ThDiA1uRm9E_M7kHSg5CUMXJLlb2oakt9oBM1UplG-EJ9fPj7dXfxRkqwxlMY80O-lGrn0iTGR42oIUxFt62scpfqaTBCyPU0sGZPoABfOzNjtohBJboedhL5wexB66njqCHG36ig8NqzwTRk5uFAj_X2kBs62eku3w4gEYg28JwPv08Tw3yaQQx0e7Z5cHmN8oSokt0m9VzlHb1r9dalP92GLQLFjD2ZzprOjVDZh5MNgM0YRrR1vsDBIVy34Y7TSlA0TzgcLzd-2EGgpgi2FiD9dXhc40NhLGxmJ2RdqAfaZXh0LsLt0Nh1pozZxAV8Ap1iP1uUqDANQax00XEMdMk7U8AUKSY-EPLD4Lt81INixAmGTTSOdGQtBoc-CudE8UGpzUk4VCvVWF6OvdUByrsbT5PW4quUoJiadTJPGT9d1ySGBxBHcAjtqxmgmFzeckPNCLDZXFvAnq2YgKUM_et1TbLhTz_yC6NUDdHiiFblg9nJJ6hWXatyz8cwlusAomWjGCRE-MhAY3AkLfBkrsxgi8XuXwDFLZ17Bn7hq-R0xSLJtFy9jNfQFY7AEkNAzHFMvLrx0TxO2OAgS0oBHio-efnyLdmyXg8qXa9tv9mxLmqZ01lpVrlHBDYgmWSVGDb87q0c7cttTv4VoPPLUnYZmo2U8b1ExINlUD39bw26HF6lGZlqk1XhwyWEfByTxEsQC0NsgUshviquiKoGILHHG4fAuarHCunTlwevYie9KYMuuPsLOIJy6IcWb3hD8uOR_5FlxMRWHqrytyq5QX5UTTiIM3zRK5Utjk9733Z-rVLSw2C_p_kzxwK9exTtnuH8mQd6oAaL7bmsnQ-UzQKh_CKZ1X99ovzi0zwiGwaZXV1R_UX8dzjTmjJ1r1dzVhQvIfRSXjSJCIhv5KdZ0O9H3tIbpR&cid=CAASEuRogovXDMTt5qdVJ7UIxHG4xA&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aef08c68ace2ca5f832b1062216d142f31d3bd2ef2966eea7de3999432a3bf0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13604
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4789 0
0 28ms
27ms Fetch
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPcGjek49YfzdENK4gAfvtYqIDNDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBM0BT9DsqCWifj8w_J862un6mINWukHyw6m0mvOI2h32EA82nROtJau98amNH2nSmxaRxRDrM1mLuiVUfRZNGmuLOhPKCUhN7CrWHZAxdVf52vQeYmAZ_UjIGBy9WVsX-2xIO4xu9GQ8fGPPQh2pCnkV9SZ1fjiw-rhv_vK9Dl0K_CjX4uYh0Z4UBOwVy66CImYnxKHjEzELZ9qYSypky0baywcNvaQxp3sSh5ROWyGgSm2J70QU7iIRfMRmEY-Rw6H90FcJpbejmHP93wHj3MAElNfAi8wD4AQDiAWa14yjMJIFBggDEAEYAZAGAaAGdoAHpOSsxgKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcA8gcKENerQhiC98qnAdIIBwiAYRABGB-ACgHICwGwE_rRvwzQEwDYEw2IFATYFAHQFQGAFwGyFxwKGggAEhRwdWItOTg3MDQ5OTYzODMyMzgyORgA&sigh=i0KZmxyVJSA&cid=CAQSPACNIrLMfXvaDUgJ7zv19f_gzRlD4AN_X_yaITW0FEkkouQn5Oq3VA4_3xoEo3Iax6U1JtK1FebcDeAcHA&vt=10

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3F54 1 KB
749 B 28ms
28ms Document
text/html 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 05:09:05 GMT
expires: Sun, 12 Sep 2021 05:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 70793
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4789 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 900de8b4001a113e49f18017b3f6bf56ed1394e9a252abdc57dbc3fc47543572

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 csi
csi.gstatic.com/ Frame 6B81 0
45 B 352ms
126ms Ping
image/gif 173.194.205.120
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ktgi1nl4&c=6786997344596&slotId=3393498672298&qqid=CMmR5bWb-PICFXCvewodZ6sGlA&fb=outstream-lima&sei=44724516%2C44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.205.120 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qm-in-f120.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 6B81 9 KB
9 KB 55ms
48ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:05:04 GMT
x-content-type-options: nosniff
age: 495834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:11:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 07:05:04 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 6B81 15 KB
15 KB 27ms
21ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 08:39:14 GMT
x-content-type-options: nosniff
age: 58184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Sep 2022 08:39:14 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B81 0
20 B 23ms
22ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CyCsVek49YcnsEPDe7gPn1pqgCdDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9ACg7Cv_EOewoAiqPJPki9CYnKsMKnoF0Cs7-EgE4BJL6Jk7RrDWhn9M7PiCyUG4kFKemTmokCwf9QLoTZhg-PxhCC0Z6E4U6BF4WlB6b5GxlTguWcochR1lqwMOi6QTZZi20DlGTAupfvECpV3Qkm4I8kBwtCMvBl17jwoS60Lk02xWyQ8z43iHvHZjVhJIP1ZpoSvsk6BeayAZdyThtH8DZA5O6nKVxE35fRFGEbcMGTn2ffqIn0A-vhx1rCGVML_1vWmGp2GzWuyFd4n_cAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ&eventType=clickstring&clientTime=1631407738797&ai=CyCsVek49YcnsEPDe7gPn1pqgCdDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9ACg7Cv_EOewoAiqPJPki9CYnKsMKnoF0Cs7-EgE4BJL6Jk7RrDWhn9M7PiCyUG4kFKemTmokCwf9QLoTZhg-PxhCC0Z6E4U6BF4WlB6b5GxlTguWcochR1lqwMOi6QTZZi20DlGTAupfvECpV3Qkm4I8kBwtCMvBl17jwoS60Lk02xWyQ8z43iHvHZjVhJIP1ZpoSvsk6BeayAZdyThtH8DZA5O6nKVxE35fRFGEbcMGTn2ffqIn0A-vhx1rCGVML_1vWmGp2GzWuyFd4n_cAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 6B81 27 KB
14 KB 44ms
44ms XHR
text/xml 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-A5jk-Tj8C_YBOA4db0mk1Vm3LR6epuCLaPl1RMzCgZdU5wiLU9pcOc7nXuMZN5Ku2cGbv0U48JawB9tk9vGKRjWC-_Uw&cry=1&dbm_d=AKAmf-CmVocfjCV1E1Q0RACJ8EnMSc8T2iNtLZq-lCIobZ924ruvkZBk0gcX34UfZQq3WZ00y5vqAPLQUennn1yYswO0NYyOXrefUzmixS5mmpCh3pNfluAxG-LbZGyXyp0S2IBVBjN0Vk2cGhlQK4dxXjBBcV7UY_ktVyUrPaTGs9V9wRJaPqeDk3JK8ONA5unRGBx-E_dKOuwtmdODyg3dC2v2koJA3vbOFvIm-NZzjFvBAfHbguqAozS_eIJv-0Y6Ab7NHstyXKjR1Xi7-QJ2YSx-iaXsOhnKoY9sLzwt6fCfVG2w1edCp-0ZbLmOV1dHkNde6qoq3BnpNJN3gQyK-kk_993yhUVTB8wIpkowo9t6F81td9OVCGniqTw8zFCT_GvZfCtoM_aDujHAexmd-GWvFbYLPVoM1LZvhGGnGdqVlaTphTilxm5E5i45PsJsteJ59mqT44kOoKPAvUka9ivsekOYTeQz0ZKwFF28n7b_t6sV4C7dtKXXkbWPlH5_nBAsMqidhJO57mi6bVxYUrJZyj6gt0i-AEe9i-iCMMwUOnxOhjFPAbYmFHU3OcisEq7zp4PKY0KRnOI9J2tUQ6i7VDM8HpFqrYs74bYm3Ue1TqmWsmuM36VMd1sEDJNrZeLaMX6fBbxgfeMia_s5D2QVAxDAhJrAiDKtK7qVm7_T3zYgNdhNcH2g2D6Y9CpoDkMv7qNaFbV4MF0hYu4qFQfL_mWCNokL1miWhd3YPW4uvEXKjSo6HcOZdNigNY2U0GJuzC3VZj0rqgJSut0oO2oNfKv49ZaxEBgaVTJZ5i2U5pI1rHkVlbAkFBCnG-daPvw3S4hjNqRKhZQwLuBnS4Xh8gSBTCTPx1XST0yOAK1YF1P5VQH2mBltnxOJ4sqD_GYDauabi50B6eBv7ix_Igr2ptTOYg0SFAx3gBFogLcHQdDrSqdseuy_ddgCDUv2GUNouPrej7K4dl3JFKWBZYGtPIFoluMqiME1VwY6SADGLeqfe5eUVinhQq3INCeXCnE8OKlYC-DKrQ1D-zuk9hjpsFssown3FiiXxXtOvwWrsxNBcA4qBPWvnpwTUwtxG-ZEvAjUz-4kHKvzFyw4-KlgNyDdIJQhYx_qYilOS62Dj1dhoidfQWhi536x09i2BOqD2o0YyaZTYJZgqrc0yzPJa95sbrOvaFsGV267MAqubRK61SL999RPD1we3VbvFCfzPSNK5rDj7xwP7PFSoCz2FgaJyt_mDrjK-1NEGmFdtdr64D74UOQfsrFnVJG-FYQYy2fpBjbdYFgPASpLymHfMdGpNNYDfgatde7EjDfqunxnbpnqH2VfF8ad53UIpRGjDgLcUKx84ayzjw2Wb-SKiPEoC74xjc_hFPOcrHIjoFa6luuo_Rjg8CLudfU_Vsr5WfnzYKFDiJqkFp6zXoDjq8i1KTW2xji8zYU1YEfqnXnbrOU8Dsvpys15k-rJUquZZbsrwZITIwIUf-c-IbnYHqShKCaFTMZtVne0mKIQtgHw0bB9BYCfohirScWKT96ReT0BZP6pJdkOkrDbD2imy65mSeP2J7bSS-jEYnOyBEgcm0qiq1VCWdNMf2upqk2ZEZMB34wqdU1BGch34Tyr6qPT1ZPYHV-PMAtzJUTOhBKY3cxhPNwgK_3arZBpO4IuBeXbnkj7_WOcyioAmCYBopAL45hmNgVmDUd7ZB4E1LyxaHFeZRDgMipnsH8Aw9ZZHCFprBWp2yTqVndyHtIjUy9xzY9R0Wnyo2GXtbJQkOVU7AZaMh82l3UHbdXDT6GyflTWt2F--FyvpVGL-Ntky4oRuQZG8En2G_FzGAgy-_U1Q-yiWtdP1j10hlLVVwyjGUAW8A_m5vQ4yu0-O4RDStq66kMNVL_9MTIBVsilcOxJDUi-AOwCpAsFoTT72g7tNq4qOyHLPSBIwDAHS3izyUiNHQ-iI2HcORxjr1NUbyPHsyH2eo2fYrEwKW9HzypSHa-6bClMQahG9iuQ5Fhkr4gLy6JkfgHDYrrUyN4_KOWBcuhN0Bay6lWWEgC9_hstiSkwNvIS5zBW3dTIFEGMG9QL-GCsvFSlpDpwCtDa7EvIaVvJ1wPu4wUKHFgQTsKEY320Ut0z8c0NCkxb6bIlz60XZK9rAo6zYKDG7mw9hFyvlHnHA_12QkKOIDwHDV-i6qrDHUITs2CMAwv8sPf677OXR47WIdM7Y25KfH2a1kPT4y0RZDWb4d6nd8ERzQ-tWf_w-DilKP7_kxeGO_TLdDSajUlSDrgYi_qwm-SAekTXxU4mcIKbWvso3G6aD10wbryIuo2r2BDKM4WH5YBbK3G1tz1da4J0TxSFF0SHVs9A1ZbpSc63vnrkXCXWQd0MOOAomWCvvWhE-Qutf1Hk6tntJFm3GWZcAe65WGVu_pB3R3YKFtFDiUterYyKuQk0kLwoz-lmdWgWvr15gEBVhPWf0reTxKYR5Xx_oDkdm80ap6QDIK5-wwXC0OqHxq3Lu3neWgG4mnvBcVWsuVXSbkeuM0vR-U0BOFzrN7O8uDDrYNs6Tr8c2S2LTvFVX4nKq2BhdbaqlOvmauE_e--kO91Vx1GKiAp57ZiK--2qkq9d61kK8OTb0NBWRlPbul3bT8qsLZqEXCerg_lVFYXjpKeluTITjIufo4Sg9Op7_HwtEc42jd4eQsRvGcJhTRVqP9Ot3n7DBTw6Wse1z0OBDxNrHaOvDvf9xDCoASpdUa1JrG9TlXmakz3-ojcx9jK5sGSgqbfXjOAt-c8xSPk2RrFlvZDFQS9gjY3pfdP91TvWw49rvhzDYYuoMK9Ztjnk9nZQNeFep0fUNFkUTdaFbCDg13rMn53A2QIv6-1SHLNY3b9-J82PLkGnCnH-F3Ul9wL87-FqZMowg7-KUZVVD_IsTgOz3t8yjL6CdNyJ9YVJYBvs7DOXXzc97KFzqDgpLaqJ8D0vCa369sFj57LdIakdgzoGPrILYHfWLkqjeJxC6W5Qu6jnpso6f2inD4zo8s18u4E8SIZZKMGB6vPAukKhb1xeu1aUKdQebDzceFyUsND4Tqs-hg6rLf-0Ciut-rRkMK8PBRM4wD2zv0z7DWMfFcp3Yh6Uwsjhiy9w_9nzUgnXYHDdq4gcvXXnhY9P9m9YxwDmL-_KywVNahvdpT9RiB1EsDmlOO2Gk6yT11J1EJHZIHeFRqDYL5O_f9M9rJORFRncc5le3snD7VNcd0-zL-cCEPacmriJZwfe70SI_Ey1NguZq8MhMJNIOcw-eCadMxKLtnf3fBUnMLmw_mA_R4uWDpRafWu89PWkUZhZ3qLxp2mNtMLdkewzAxmLc3GxvQ2HsCdyN0f49PYUs-7YNnNRt6GuZHtHHTXLPccjf2XsV6SUTsIfe4UqoI76m2V5COVdaOu6Dzx9GDxKfPDgYLr0STAH4Ny9OOYBpkcdqyvatAvSVIHO7Nnc98MhVBsXJjQdOmgAEJoIGnHxqYYOwb_SEf3PeylK_5S2_eoHJEw2CfpaB4J2FRs9UxP4RGskhaHbQrq-EpL4E9YMRt3RoREo8-PEE6KLihEPO6kj0Lh2s_87jZCCtWkQ0OTcqpTxalSKVYUKWTe8iBzYbureVdhSULdZv5QUA-uQM6bBBkAtKrejKJgpVdS81tLlbVYM&cid=CAASEuRowS4l3FUPzCPraas9Ce_zHg&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

935f09665075e25469b1da0c960aeb8d19eca4897c3464273b6e683bd7987417

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13668
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6B81 0
0 19ms
19ms Fetch
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CCU3yek49YcnsEPDe7gPn1pqgCdDruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBM0BT9ACg7Cv_EOewoAiqPJPki9CYnKsMKnoF0Cs7-EgE4BJL6Jk7RrDWhn9M7PiCyUG4kFKemTmokCwf9QLoTZhg-PxhCC0Z6E4U6BF4WlB6b5GxlTguWcochR1lqwMOi6QTZZi20DlGTAupfvECpV3Qkm4I8kBwtCMvBl17jwoS60Lk02xWyQ8z43iHvHZjVhJIP1ZpoSvsk6BeayAZdyThtH8DZA5O6nKVxE35fRFGEbcaGV9LGR4Qu-OUnYMcj6dvXXNPUK9mVWdTovuD8AElNfAi8wD4AQDiAWa14yjMJIFBggDEAEYAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHpOSsxgKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcA8gcKENerQhiC98qnAdIIBwiAYRABGB-ACgHICwGwE_rRvwzIE9io7twD0BMA2BMNiBQE2BQB0BUBgBcBshccChoIABIUcHViLTk4NzA0OTk2MzgzMjM4MjkYAA&sigh=NzJFxNxvX9A&cid=CAQSPACNIrLMCvn99O7Vxf9vxXr0jsy5KfNFA6Rh39JJBV7Qg_9gg2ul6Ee5mROgb-C8LXDyuFAZS2XhjGl8BA&vt=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E014 1 KB
749 B 21ms
19ms Document
text/html 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 05:09:05 GMT
expires: Sun, 12 Sep 2021 05:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 70793
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6B81 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4528b7fbc6512706e86c4dfaad657cc35861c4f1ad556cedee291ba27af65236

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3F54 35 B
463 B 42ms
8ms Image
image/gif 91.228.74.226
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMXKKXtzWzrWcNO7SJkGhcY&google_cver=1&google_push=AYg5qPJw5G0SfpQAQosEl6DxHqfOCXmQfOh4iwvrBfTUez3AU3Tn1dY4A_btFbTCKXif63KtZhB1PbaO_gu7eGionA5F_gcAETEA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.226 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F54
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPL-inTeMtENI-6iYtbp0_e3fPkrBSpctWD31pxg-0Vb10e7xXuWRzC-5G9-o0yEqSVDqro74WOyNSqI3kW...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ctBubGcQlj1WtxKlsCbG48&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPL-inTeMtENI-6iYtbp0_e3fPkrBSpc...

170 B
188 B

47ms
47ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ctBubGcQlj1WtxKlsCbG48&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPL-inTeMtENI-6iYtbp0_e3fPkrBSpctWD31pxg-0Vb10e7xXuWRzC-5G9-o0yEqSVDqro74WOyNSqI3kWzi20Nq-3SaznD

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=7884000; includeSubDomains
via: HTTP/2.0 odnd
last-modified: Fri, 03 Sep 2021 11:24:13 GMT
date: Sun, 12 Sep 2021 00:48:59 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ctBubGcQlj1WtxKlsCbG48&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPL-inTeMtENI-6iYtbp0_e3fPkrBSpctWD31pxg-0Vb10e7xXuWRzC-5G9-o0yEqSVDqro74WOyNSqI3kWzi20Nq-3SaznD
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F54
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEDvea7wSu-pEI8ISnRipH2w&google_cver=1&google_push=AYg5qPIJAaBMR9HRuhgq7n3dJUgKrVZxEogaVI6EBo20zhwPkBk1G5yKUwwcQrFBMRBVQtW6H_oOVhCgm_yqF8DqZ_2ZfraP06ll
https://rtb.openx.net/sync/dds?google_gid=CAESEDvea7wSu-pEI8ISnRipH2w&google_cver=1&google_push=AYg5qPIJAaBMR9HRuhgq7n3dJUgKrVZxEogaVI6EBo20zhwPkBk1G5yKUwwcQrFBMRBVQtW6H_oOVhCgm_yqF8DqZ_2ZfraP06ll&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIJAaBMR9HRuhgq7n3dJUgKrVZxEogaVI6EBo20zhwPkBk1G5yKUwwcQrFBMRBVQtW6H_oOVhCgm_yqF8DqZ_2ZfraP06ll&google_hm=RdCzyBLGxEoF_4kS4XwEcg==

170 B
188 B

18ms
18ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIJAaBMR9HRuhgq7n3dJUgKrVZxEogaVI6EBo20zhwPkBk1G5yKUwwcQrFBMRBVQtW6H_oOVhCgm_yqF8DqZ_2ZfraP06ll&google_hm=RdCzyBLGxEoF_4kS4XwEcg==

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIJAaBMR9HRuhgq7n3dJUgKrVZxEogaVI6EBo20zhwPkBk1G5yKUwwcQrFBMRBVQtW6H_oOVhCgm_yqF8DqZ_2ZfraP06ll&google_hm=RdCzyBLGxEoF_4kS4XwEcg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 2hfi3oai7cd0hkf27kovuqqi9e2ukeak

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F54
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rtPWr9VRg6sEmSYNys6nA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

49ms
49ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rtPWr9VRg6sEmSYNys6nA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLtMgCoVkuv_kA8aMoJb8AELap1FF4R-XhK73ET10sMAV6ZAjkWhcx1V-gyzGxWpwTrdaHhX88ZkZr8b17qWJ49auojzXIe

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rtPWr9VRg6sEmSYNys6nA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLtMgCoVkuv_kA8aMoJb8AELap1FF4R-XhK73ET10sMAV6ZAjkWhcx1V-gyzGxWpwTrdaHhX88ZkZr8b17qWJ49auojzXIe
date: Sun, 12 Sep 2021 00:48:59 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F54
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKjPuHbGRWFo2ki7yyUFO5I&google_cver=1&google_push=AYg5qPKv6yWrK8JaWc3l8A5XHMR03p80hMAG7D7O2oZZvGQ4OXBRwlC0krpVu9rgoKow3c85eVS...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTjgtQS03Q0s4&google_push=AYg5qPKv6yWrK8JaWc3l8A5XHMR03p80hMAG7D7O2oZZvGQ4OXBRwlC0krpVu9rgoKow3c85eVSHZ9cAUGTuVs6Pzi1amRU5mkM

170 B
188 B

34ms
17ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTjgtQS03Q0s4&google_push=AYg5qPKv6yWrK8JaWc3l8A5XHMR03p80hMAG7D7O2oZZvGQ4OXBRwlC0krpVu9rgoKow3c85eVSHZ9cAUGTuVs6Pzi1amRU5mkM

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTjgtQS03Q0s4&google_push=AYg5qPKv6yWrK8JaWc3l8A5XHMR03p80hMAG7D7O2oZZvGQ4OXBRwlC0krpVu9rgoKow3c85eVSHZ9cAUGTuVs6Pzi1amRU5mkM
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 3F54
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YT1OeosUIW3h_d_0Hc3ekQAABHoAAAAB&google_cver=1&google_gid=CAESEE5LEraiQiuyBKr6nobO5Xo&google_push=AYg5qPJog-5gn0rhx4DybHt2uJHNI8iV-aaWz...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 3F54 0
44 B 1162ms
289ms Image
text/plain 18.182.119.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESELqXLKEYV3PslB4Qa93yijA&google_cver=1&google_push=AYg5qPLzgGVVh6Kaa7OPLP7GqCTJCt_7LNBblN0MOkp5cmHDbDMx2D4BpSyQ91RfSiN5HruLay1bN9791nFddybKLFgg0_foUqtl
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.182.119.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-182-119-142.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
server: awselb/2.0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 3F54 0
253 B 50ms
14ms Image
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LkHWJCZZ8TOFNBbFp30xek3tAM-T0CPoTB0F5AMa517PYKPCD8_KczE_dYoRGe7_XEZD8f

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2643714513&pi=t.aa~a.743153278~i.3~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280&nras=3&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4168&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=r1NoquF28H&p=https%3A//credits-online.kz&dtd=18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 6B81 41 KB
15 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 05:55:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 586420
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 05:55:18 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6B81
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

80ms
16ms

Fetch
video/mp4

74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3D83EEBC8E8B58C4FDD3B5264D44A1EA83E44713.54A1DC9C6D35D2023FA3BC5CEA1BD43509B40CDB/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:59 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2213070
Last-Modified: Mon, 03 May 2021 16:41:09 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sun, 12 Sep 2021 00:48:59 GMT

Redirect headers

date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 645
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3D83EEBC8E8B58C4FDD3B5264D44A1EA83E44713.54A1DC9C6D35D2023FA3BC5CEA1BD43509B40CDB/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 4789 41 KB
15 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 05:55:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 586420
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 05:55:18 GMT

HEAD
H/1.1

200
OK

https://gcdn.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

96ms
23ms

Fetch
video/mp4

74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/699144644C2CE9B1C45D8A5DC9ECE4248BF3BA31.58F445BAFE9F7B6D43867FEA60C0C9BA0EF2AEF4/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 12 Sep 2021 00:48:59 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2213070
Last-Modified: Mon, 03 May 2021 16:41:09 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Sun, 12 Sep 2021 00:48:59 GMT

Redirect headers

date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 645
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/699144644C2CE9B1C45D8A5DC9ECE4248BF3BA31.58F445BAFE9F7B6D43867FEA60C0C9BA0EF2AEF4/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 7EC2 18 KB
7 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7EC2 8 KB
713 B 19ms
19ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 11 Sep 2021 23:52:19 GMT
server: ESF
date: Sun, 12 Sep 2021 00:48:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 7EC2 14 KB
3 KB 18ms
18ms Stylesheet
text/css 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H3 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/ Frame 7EC2 357 KB
124 KB 15ms
14ms Script
text/javascript 142.250.13.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.13.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aebcd38397f33a5e7c8d39dd1dcb0eb19618cd23cd430a535c9e8666542c815

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 02:44:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252291
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126725
x-xss-protection: 0
last-modified: Wed, 08 Sep 2021 22:21:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Sep 2022 02:44:07 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 7EC2 14 KB
6 KB 13ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 99BB 624 B
297 B 19ms
18ms Document
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD99gIQ2O7--gEYyYL3fTAB&v=APEucNXA9A5PPLBUfLzBKoJyWRIGSSWAXMFvwsh8qo74K5N-v327qykmYYlf3fDgjAFFqatqaH0URqAxR1TPzQcVhPPeO5VKjw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJD99gIQ2O7--gEYyYL3fTAB&v=APEucNXA9A5PPLBUfLzBKoJyWRIGSSWAXMFvwsh8qo74K5N-v327qykmYYlf3fDgjAFFqatqaH0URqAxR1TPzQcVhPPeO5VKjw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkTSl5bzyAx5hBSeSfcY5-dHWYXumtDVfxZzeG3OnVRF0RNx6frJkgEis9sOHQ; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 12 Sep 2021 00:48:58 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4867 71 KB
28 KB 48ms
46ms Script
text/javascript 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B8ZriNMJowdTqRjXGDnjxlLEJiW1aGyClCrgDxW9dvlgxwGWulNJr9sQZ1g5H_Rmk7LIBUVHsZ99qa2c6zAFjzID93_xIsZnh2Day_HyCyCRmTfg882tgM_Eh9J_qCxpfErsSD-T4dPFdOIZrnBebDa5vIaw&dbm_d=AKAmf-COm_gP6yCWMYRxjefoNg6AcWkam-XDXnf59u3hikj_Kevcvl_jTNWlYKzUMYK0U5v1xGy_eO8Cr4_MuoP6Wvz4KIHu-JPfPimFsNLb5b5kdJhHUStjx234X_QCs5_7Ierm1pkEHOQyiMFCgFAGyCz6ZptB5SyR9NCdQUfQbX0zmPcn8V_9VM0kxE2nOS3F2LqeSXiOMn1mk9ovQ_xAXm5W1Tmkq75loVOlz5xdDpZkVbtRVI7UjQtlm6wUKKjEzliBrpDLiXcwI8h2Lao4qHsvA3NWYWUiMkFViDX2MnrnMFxRA8sTm-BBT0dXxwsEZhaHd-ZToWF4JrYjpIfBPXMex19FycvdjnXg2AyGjRNKIu6iF1sRYTKSxudpKmaCO1henpwKSxTDdRBmCxo3ZOVby6nQIroecxo9BdI3pn42NHHJBWc-MbCzgwZXgBkM6jCaFenvtmw-uhP_jC3_B0M7j1y4EXYPohFRWEEy6UzzTIhOWEpyI9s8pMosBorLQ8OflQaezi7nSxZ_YuktejtwRGvkuX3V3QOL5ElEjR3kZ5FjIGAqkmBLOretqRQ933BrPCd7MW4MZ5pd5EGpOk6K0hZ--Pb5N8MLQEjb-8UGVhYksoUaZsPRtJpsVxQBn5qLw1hHie-Dz_qZsXD5fM45SfA810uEVYkusMNqTMOCyDVd8W-F18b4i_q7D55fld_rBorgIuPKIKvVl4AhWUb79-PA1whf-LdlTSZhfKXWy3Qh1ObgEvyfm3nfi-mIOxLDVfHjZG4DRaQKP_NQnR49ZpmG7kgRezk8vKWsfUlhpgCP4MBFg70CEuG1oW-IBTzrALt1GYxrZtY4_9UMO869h1Z8tSnVENi1AUWK9SeqHWxepM8uc4aWn_qSOnxYYZxz9pCpLtXPSgX1svqBFNM7NLLSSWQIcvPbX_rnXc6kDmCCHvEp-av6oDU7OdAXkueirQGSW7XhZ5KFw08M96VTMKcnxuieWrIvb1GTQwsi4-IO_RLhNEnoeCUE4caASohdwOk1Ph11Ty47PavSgzWraL-FKMIlyLLdlPRdmELEyqexyf4CxeixAOam4xz3Y4N-h8G70RR34h9T_FWZWC0RTtMJCw7jy16jz6nsjCEjpG-gjXq2bH7GBRp_NdCfDYjKzOS9klF2tWIQJsdWW_9EYAQFmh2HpvQI8pvbhkNRV1djnQgHSnhIa3bS_SOHsQb5VFK3T7oBqxHT77SPrgsDw8XtZMg5smWD-U3X8J72_NvO-nYMf1nIebJ0IJxUt-UtqVeBSX1ZCgRiHqMBuXQKej5DmfpKIfkgf-Qcfmlr7PEW_yTVIwb_QHj9aSrRFzSx7ir-GVYvIdDC3_wKhw2F02yRl9r_gOWOGChhb5oneqv-Y6j0lieZufDDlKeF4g8nHqgiUy9v686eKZNHRxcTPKFdchw0mgE2Y0cDdDrIqQpoAK2tWRQQEwRWjCH2mPrUJM3pgkNPfGz5wTYpNlxyKwgbDIZCq0OmF89wfmW6hWNDgF87poGs7l46tkwGkW2LaKVn8u5hkCX_mMOuib6HUTrB3HJ1lPD0t_bP3jG1DVajWIee69Kcmv7goYgni6JbBsCW7ml8WypK-pM8rkJ2AXLlz21ZA71SgnU6Y5fp-QY5z9Q6lf9hRhYBttM0nT5vlG1W0-STICXenxg5Mp33o17_B425NjKslZaOjRknB3jwIdrkmEOPjD0dvLeDat7qgJvPGGiyg4_Am_mGckEoJCtsjypIsB-xO9MEpzOcJFS8mYQ06gpRuUZVsfrNllKHcCaaBojI35Y74OC-RQ9nydItqalgZgFnCPYCYUwdQt1QejjTOZ-HbnjDlctmi1utu4mIyj2MWAuPQMiB6gGYW3lzrKIe2Cb_-8eU6iZI8_I9q_Dy3birtH5-n4-JiSjupbaQkXSsr9CuEykF_GtF7QLuJbQD5sVZzea-RKNYshGucr6zSUA-Ob705X4idvkkdZWUanzL0mwsJTabBcXWQyAVVC-jkYEF3w7A3lnRUqAjHBkKNy6toIa45r-s5FY4eB2S2Jm-ClLWLk-mZsyPl6sbGjq8H-NJRsrSCQsZvknteKsvMgdewaIaY_2uGJHIOuBCpbK3y6rW2wUCLaAXn5fWACU-iBSEK0KeTsOCcFH5RBwi1wp0DbY91YAatm-A-pNEmnQg8YGjCHHXFaCMRFU_SOYaf9pV39TsOzlQy6eG69Vc4udXyawRgBpvJLa7CNgWrtmRnRzt9JIn4o3iVQfUHD_jr0cxSILsodGIeZWfQWCE1Z47Dy_yofL3AvcsySclnjlL08-elS7ubs1FVlhpwxwkUdxmVn_GPBaF8PoHSGaxXkmtg9Zp6s_4x0G7vIVg7hC3xQwj3bGPGEus-IFhjaqFKJHpyaP1wlE-VqpOBAFpzSTefwSYla_0MQuuoaFWrFk3jEEBJX9zd4SCoupov7Yd264W_K-F8aAZ3ZzVHSSlaDL14JtVbHtwSkzHaApn-hr8FKyibZTScdrL14kRbUXB430vCfJrHoy6bHYAGYqXVc--8guLEDDbEmQFkQTG9xejWHE7q4H4l0FsJpt2p4HDcorjs01IQZviVNZ8ootBmIuj-WDPx-CgjfOIDNKWD8QDZiLzQkzZJng8uSTrWWSCCgqlE8KrqyAHBFmppnRK0AWMZcA2FTZg25Iv6WmrYKYVtgEn7BzlQEWEcO-ri2V0YppjEpv-l7eqM_JWkW94ExyHlh5gy6Buev8NEuMiNSbGWw0c18ogRzhcV4KH5LVwSWCaEFGwR_bzSjAjBYJvo3J06Br4NJEzl_7L_oRf8UOoEQZLDq_7HPC5TtJQldYWzwFOxQ40HsmSc0fYq1_gzpY96WS907WCbnso_fUgVKkI_mDlpnENNHNSYBAdk8d_FG85rOBYC2VRvDGt7IxopLg5G0btIrvMxh0flMC6&cid=CAASEuRo7-4gtQCBSUbhDFS7ncENgA&rfl=2%2Chttps%253A%252F%252Fcredits-online.kz%252F%240

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

153d7889a997cb8a295f2ac9200d4dc9544b69601b1240979d9e38406bd682c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28990
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4867 2 KB
1 KB 14ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 10:52:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50198
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 10:52:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4867 125 KB
38 KB 26ms
23ms Script
text/javascript 64.233.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38649
x-xss-protection: 0
expires: Sun, 12 Sep 2021 00:48:58 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/ Frame 4867 14 KB
6 KB 17ms
13ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210908/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 16:32:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 16:32:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4867 0
0 18ms
15ms Image
text/html 173.194.76.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSn25QAZrqof9Rpgg_AQoglm3JGm_hMhjmgAfBHand50k9T3vE7xgKWz2nfNtZef9b-1ktfwZH4buah2o9fxcGa9GWlCA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 173.194.76.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ws-in-f99.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4867 42 B
63 B 27ms
23ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CxuCpL9SmxNbd2RHPy-Zt-RF6RkwXZz65vQladgGzz-PiaeEUrHzKiSlnrzmSlEuhz2Z6OeVTfX-71Yi_bjT1CvqzePgqDsYoVaMHEBTVk5CrixN0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E014
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLFKBPCWgqUOQML21M5RwytsnOeKchgbB8WxYpUQYyp8FRdoUuE5W6UZxI0YiWIlBM8hB09R7FWrQed_uVmtGR-Z5-pWg&google_gid=CAESEJM_SypOroSsCHzU7sTKPao&googl...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPqc9YkGEgUI6AcQAEIASm5nb29nbGVfcHVzaD1BWWc1cVBMRktCUENXZ3FVT1FNTDIxTTVSd3l0c25PZUtjaGdiQjhXeFlwVVFZeXA4RlJkb1V1RTVXNlVaeEkwWWlXSWxCTThoQjA5UjdGV3JRZWRfdV...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSi1RRExqZlRmZkVnS2Nhc19tYVpXWDVDQTIxZnRDVHZPYU5mdFNmOUR2OA==&google_push

170 B
188 B

26ms
26ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSi1RRExqZlRmZkVnS2Nhc19tYVpXWDVDQTIxZnRDVHZPYU5mdFNmOUR2OA==&google_push

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 12 Sep 2021 00:48:58 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwSi1RRExqZlRmZkVnS2Nhc19tYVpXWDVDQTIxZnRDVHZPYU5mdFNmOUR2OA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E014
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIJeu70ZCG-h3bFWSCbvN4eCn9W-rWA9R-FyKy89A6wpTSBinB86RQKr0p6Z79yvWHdvj39J_WBkT7eomm...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=XOtsskGtFUBS0clNXW-zIY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIJeu70ZCG-h3bFWSCbvN4eCn9W-rWA...

170 B
188 B

49ms
49ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=XOtsskGtFUBS0clNXW-zIY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIJeu70ZCG-h3bFWSCbvN4eCn9W-rWA9R-FyKy89A6wpTSBinB86RQKr0p6Z79yvWHdvj39J_WBkT7eomm16k3ppJlqnZg

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=7884000; includeSubDomains
via: HTTP/2.0 odnd
last-modified: Fri, 03 Sep 2021 11:24:13 GMT
date: Sun, 12 Sep 2021 00:48:59 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=XOtsskGtFUBS0clNXW-zIY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIJeu70ZCG-h3bFWSCbvN4eCn9W-rWA9R-FyKy89A6wpTSBinB86RQKr0p6Z79yvWHdvj39J_WBkT7eomm16k3ppJlqnZg
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame E014 43 B
606 B 56ms
23ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEAkqSdLh8Hder4_kwX0DhWs&google_cver=1&google_push=AYg5qPK4WVR9P9_59SBqEyk_j_4meSirjoF1S8xNtt3BHVFYHdy-aza68S-EsDRTqZl_pnJ-LoiR364L_i653uFnt68Uvd-oxQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E014
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEDvea7wSu-pEI8ISnRipH2w&google_cver=1&google_push=AYg5qPJOhX69axnjfgl29kClctcT3hsEvynTptZyg8aTQqqELZGfTRs8lMCRBpOvU9En3evJmKXI22FWS3alT9defIEdkf6Vaxc
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJOhX69axnjfgl29kClctcT3hsEvynTptZyg8aTQqqELZGfTRs8lMCRBpOvU9En3evJmKXI22FWS3alT9defIEdkf6Vaxc&google_hm=RdCzyBLGxEoF_4kS4XwEcg==

170 B
188 B

27ms
27ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJOhX69axnjfgl29kClctcT3hsEvynTptZyg8aTQqqELZGfTRs8lMCRBpOvU9En3evJmKXI22FWS3alT9defIEdkf6Vaxc&google_hm=RdCzyBLGxEoF_4kS4XwEcg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJOhX69axnjfgl29kClctcT3hsEvynTptZyg8aTQqqELZGfTRs8lMCRBpOvU9En3evJmKXI22FWS3alT9defIEdkf6Vaxc&google_hm=RdCzyBLGxEoF_4kS4XwEcg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: ho1hcd556hvcqteeg8fpl3g6ct8ehhfh

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E014
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=xmK89B3UShqxnt1t3S7JTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=xmK89B3UShqxnt1t3S7JTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJb9NCqwX15xeKbcMvoKPd18rzeOrRpAPWMC-mhDIR0AX9ZdNGF7w2NGg19iiacNZPkamdNZcbeH9o8t2oFTA5jsf2-qpE

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=xmK89B3UShqxnt1t3S7JTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJb9NCqwX15xeKbcMvoKPd18rzeOrRpAPWMC-mhDIR0AX9ZdNGF7w2NGg19iiacNZPkamdNZcbeH9o8t2oFTA5jsf2-qpE
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E014
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKjPuHbGRWFo2ki7yyUFO5I&google_cver=1&google_push=AYg5qPLEo7FOdikNTunmaP6ui_mx49cJmR5gTChbkOhUvB7ia8m3d8CBf5zuCzAAwrTsR5cw_Fg...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTzMtMTktNUYzVg==&google_push=AYg5qPLEo7FOdikNTunmaP6ui_mx49cJmR5gTChbkOhUvB7ia8m3d8CBf5zuCzAAwrTsR5cw_FgLKExQYDPzi8qfDKBWPG6R4zk

170 B
188 B

29ms
27ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTzMtMTktNUYzVg==&google_push=AYg5qPLEo7FOdikNTunmaP6ui_mx49cJmR5gTChbkOhUvB7ia8m3d8CBf5zuCzAAwrTsR5cw_FgLKExQYDPzi8qfDKBWPG6R4zk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOTzMtMTktNUYzVg==&google_push=AYg5qPLEo7FOdikNTunmaP6ui_mx49cJmR5gTChbkOhUvB7ia8m3d8CBf5zuCzAAwrTsR5cw_FgLKExQYDPzi8qfDKBWPG6R4zk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame E014 43 B
296 B 193ms
30ms Image
image/gif 18.134.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEIrdJm0d0aCvA7nn_OcbRiA&google_cver=1&google_push=AYg5qPLQAmqO5w5iy6qvRsdnRNVvQgAZXr58-sVQh-L_lPFz0CBJvr_88txnVfW3hVdeNLT0Fmep55DTtXwg0BzOj1h5wyqJ-A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2435165247&pi=t.aa~a.1135700519~i.2~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2671&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280&nras=5&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=5087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=NKm36hrhkH&p=https%3A//credits-online.kz&dtd=24
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.239.147 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-239-147.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E014 0
12 B 16ms
16ms Image
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KbRQwKZITh_qs8pR0VimvUInBWLl8h3wVr_lRz9y0tkbEqUWDPewWE9zGZ3jUKIZxVhfSd

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 54D4 23 KB
9 KB 17ms
15ms Document
text/html 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8727
date: Fri, 10 Sep 2021 16:22:57 GMT
expires: Sat, 10 Sep 2022 16:22:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 116761
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 8EAF 23 KB
9 KB 16ms
14ms Document
text/html 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8727
date: Fri, 10 Sep 2021 16:22:57 GMT
expires: Sat, 10 Sep 2022 16:22:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 116761
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H2 204 csi
csi.gstatic.com/ Frame 7EC2 0
45 B 213ms
126ms Ping
image/gif 173.194.205.120
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ktgi1np0&c=5381568824561&slotId=2690784412280.5&qqid=CP795LWb-PICFVJ-4AodnqQFNg&fb=outstream-lima&sei=44724516%2C44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.205.120 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qm-in-f120.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 7EC2 9 KB
9 KB 28ms
28ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:05:04 GMT
x-content-type-options: nosniff
age: 495834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:11:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 07:05:04 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 7EC2 15 KB
15 KB 29ms
29ms Font
font/woff2 64.233.184.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.184.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 08:39:14 GMT
x-content-type-options: nosniff
age: 58184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 11 Sep 2022 08:39:14 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7EC2 0
20 B 32ms
32ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CwFofek49Yf7YENL8gQeeyZawA9DruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9Bny9TZnZ3Czjb8-pIa2wVoV6yoeSttGEh6DkxANtmZzb4cm5zHlhl7mnGBFum9u8BA7L69jXDIUMQgjGTAk6AOgamUL-GpFee_jDDlwg7PvPZTQXVKq8qT9a9o-Qgyjy6lHCCDwU_cEtAiAbU1_ONq0J9dv42luOshWUJGbHZSGNbyExhDhAasgLyld_rQfqiCAeapBYB1NPQQZRM3jDOyw0wAZ5k-y1MlE4x79y-sRwAdLIt61ZZU_zhTSlg-mih7np0JMnZfsZdQCJnM0MAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ&eventType=clickstring&clientTime=1631407738936&ai=CwFofek49Yf7YENL8gQeeyZawA9DruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBNABT9Bny9TZnZ3Czjb8-pIa2wVoV6yoeSttGEh6DkxANtmZzb4cm5zHlhl7mnGBFum9u8BA7L69jXDIUMQgjGTAk6AOgamUL-GpFee_jDDlwg7PvPZTQXVKq8qT9a9o-Qgyjy6lHCCDwU_cEtAiAbU1_ONq0J9dv42luOshWUJGbHZSGNbyExhDhAasgLyld_rQfqiCAeapBYB1NPQQZRM3jDOyw0wAZ5k-y1MlE4x79y-sRwAdLIt61ZZU_zhTSlg-mih7np0JMnZfsZdQCJnM0MAElNfAi8wD4AQDkAYBoAZ2gAek5KzGAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYH4AKAcgLAeALAYAMAbAT-tG_DNATANgTDYgUBNgUAdAVAYAXAQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 7EC2 27 KB
13 KB 59ms
58ms XHR
text/xml 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CukO-EbCD0z38IlMpHGkV8V5PjkplUg63ctj1RTQRYd0j8gPp-KFLDkroiRb_wXghK9Recgxny5XofpBTItLJzQ9n2zQ&cry=1&dbm_d=AKAmf-DOODum7ImgUHq-nvRPWFZLvMZRxwTWH2xTXZmZwFqVWbgbdkJUriLKC5kotrA53mn7V0kuqmx4iYz7Q_vDO5cE4m6fdfwyJoaG2wKPwb3nkWoyaGbf0uIzewwdIl_U1jTvV8Lxj8NGPedyhOv06MJ8PYYZ5UewYRPV3mQdOS3ancUMvqumhVuaEN5SkAOvhtjvnAMsAdyg48T8JnBai3DCruTf6Sl1pKxrDbY-OU2h8d4HvRt11VIU2MWBuALj5aXK0EVi-OaHz__2-5hLNg8k_Nr03WIJz7bzMBU_7UU7lyT3NEsMpK36c_tZRi1VbmpGJnRPZIYV8aKpWOfm5WGyI8hHeySLxwQxqeXBlgZCAKgPi8WRHB3CE-2HeDztbE27CPN1HLxjp2FJ1pc6qcrYCJYnkfQHHCOmEyoSfdrAcHQqm6yXh1pM6aipWKAYLLCHu11fA4rCMNJutFrY29xX741vM6Sg6YFU2jLygBg-AVvorzxwhSBNqnMhlsmxpORODIE6KD_NU4PJxNUfT_PxoYc4Sy4GboYRUVCUouZUBx6VnqAiV0Vhtd81ktEfvQiHkbJnHSyGdPjZqG9GbwBZ4q1TNS0pUDzffQ_T5-iqlatALwx_ADAv-nynhvGeg7fw709KwTzJDT_A8rAdOfu8dSyBt7A-rSqRWM6TRqXeAcCNvMKPhkRRgf7LHeVezzwXUfaroutsDwfPNlibgyvcq33IaEVmPUG6ubYwLCTQrXSKYGD05fuLEXbxs5MJDmMmbBwst-SajnxjpKDfp0UmfTE9Hl6tNkcSJ0xt2PouwYV7Qmoe8-qaYVMWcrxeJNWUSGVXEYeSPnozAKU52iEzsOSd_IiCbuuww1GCdVvF0WkNQkXha4gIvB2THhH1hV55OEGpspRMuIbgaQqIh7xo7qcU-8g5JD4NuHm4mb1jIBptFk66rXc2dxK6u0UwqMSpRexs4yua3aL-PNoWRZU-1VAk_jZp8p9lGWRzr8PCWAt2Ak5fPn8nAhfiKT5XSMjCPegmoxnIvLR9NxqrCec9m0aTX6nVJZJvCKxdZpZlGveWt3wara6rblF2YtRNI6P-5wj-SYZhrRUNn9ZeeyMO69MJtTgNQFNu_OTPdOmXh5nDeTdUEmj_DMEkxT-0kdDQpMIAJV5SZ9mXnJ_B_lx4Dy5Tjvk1VRcf-SGxeB9ericFabnLkV1skvr4meGKGWKHe6whWncbvKY07f4KIMyjjJ0fnNptk2Y4ohNsLEbE-r6vibV6IcFk8nu-nhACvFpZ-uUFAu8_iROwTyrhsArAuikn-9FpXAHcSoo3vZ-tmsJKyfM4hj9AMHjonEDVhRNM4_BtlkfrEQYRZP7k_7fW032E8bCgfFx9W7O8W633F6MxkGGmYo7BGfXV8zi9oRqPT1qdYmZcusakaj7Uq3wTad-2d4_FZpPlVJUDCJEEyJ-WcRVgkJ3GoGRPQ281ft1ZxvQQLjJtvWWTgXEDtTH5Czmv6S0OXP6fGxjBwX9ofCb3D5KN-W5iOoKlWGelI0LfBLUuqWZX2pkWDL3iQI9DI8b8i6B7FSgMBXg8w8XaN0b1kWzZS-r0XpFr4gc04dyD6Teea9g605YL-bTMzXWLzwHUdij4a9TENHbhgminz5BOXVdSRy2Bv0X44GBd1jWSroVgsBfFcdgjzv2qSN7qgSBm9zeqwtLNbxKkBt_f5DgRfYI3SFBUnyQDRqhKt89UvWIYHzGOpHvJc7YBhJj4DzvqaAx7oDrj-1KtJ8T2wVKVEzksJBfGS71O7IlMunoomN-ZVtuMkFPFGpne1ZmuAej2YCzFEK5yRnJPEabN-I37GunHaStTXIv90kuefuPhMR_hpf8TS37w8BIWke-RnwL9HtnvY2qlno5MydC2KpO4k3k5XzRPdhSvENe-cWua4dsPH_1aVfGLtQWdKZ8AF1vX_cTVJpEQpxF_AgpPZckkqLFCx4mV5z_M_LeIpeOg7nD3LeVcPfUQGoRI3QVQTwHUPHIJdsuko4xaWVr2R2xoupNIpLpVo-yakl8O7p2ktF2HR4jKFmvYLSsH6RYL4K5AC_gDD1CRohJnoRHh-HQe7LTAgKjYohO0Snx0tK-jQyI1K0jFOQleOrcn8-Ks9cKJ1lybynUnU7_991QjTp3CnXwyJqtURm7MVtjKmEI3rqAKPTfFdyn3LBEtplzh80WYkT_ptx29QNoVWbOlcjJ1cbo4b0DV_qeDOQMMNo44rzzVyjWycvM5Hn1_2N4kq43bd32d-t6P36lc3GqMCUI_PLK-kc4IdjefKsa0GCi9S5Fr0ttB21_NYrXWXD1HmLx9vbSKAFYE_VgUBmYvlm5Fl4VqPyniG9pFQtJngAhtew23C1pJdIAGp64FQHljYbE70Di45G7R3DT_nqxrj2qjstGPnLjxQwOJzgQz2HEYgoXK5jwqxWefdrmGnVHw_Lnxiw0INXGYj9OSU_up6OGJOoDhocwfIEtDQweh0isklxuXYeS__xt5fnDQpZDt7zDB575ywlYNwXWa_1wUZEScRPp4ni48Z6C8uhpl-GP0RWihvoA8gY62rBusPw2rJVcOgZWFvniLMHsmrcFvLVm6pff1HkNcxHpvUz7oEhwy0PYOapnUww5m-VxdspvhMhhBDf_XDNvEQLETtOT6Uytx5Rpim2UsSoE0D1MOYf1o89IetkAc880uUcZQMLXzkpbpWM7WCRHKgbpcPLb6CMUgrCZdK-v7QSZ1ksSRaFEySBsI97lKH8TvG7kiF0M68xi-xzfmK4kcwdfwgiDtTltnNQ7HUk0KP5-jMyzshrbqgPuFHyIdgDlvAQEyONcbPOA5CQXVzFLYAmiaHfNLJvPf85zQ8VbsTZUZROiXLOHOZYLF5RIWnklEoNOw4cSyjcQJfQQ7TNkh7yv9ihVrW-Cpdp85R05jfilM8bhB6lKw9MWkaxS-zHWpMCtyrA8FblrmDXmU3Us05p8hIDX7Vhy86vS-apXTpxslg0a0m4oIesxIh05sdlX8Yvg3mNjWlBfamOIiZy3xhoa860d1oWMOPqryIf5h-vgj5Nxw-aTMcwpGN0niUsRzgifbQ5kKp0VDVTNw5DhqKw4Kf0cmuG_LmCoMIsA9ARGI4K2D2KuYrxzWwP5n__Xvzn2MMtIn0em8PFF3mTHdfnZQKLgkGmyLmp1nODlH6yJCEowlKa7yZrTNNhvEe2ab5kAH7kPe0dQ98QjOEqv27Gp3GLwOYGRe4iQ-msDSvFNh6Sx7auU98i1yEDixKjBf2gx7rPaXDN21NX1UYe3OL_hNDsbuK11jMxlw2QJjp7f5DU_sT6IzGaHSg29kJDYemI9OSJAWfxQDijESd5kcfqAMVsPWRw9P8ZAqyL9GgwVGmLdaAcMp3bVIArWqrIBJ8NzE1Mlhm-Gju1_FntwhRpwCS0As8Vpkubxvr-6OzjImcVdzPJhoHm_3CIz5qOyw61fncjMaE48LS4PGdFg2cC9dHTehG954X8mir1Nm_sP_dQQ-ebgi_RSoENHwV1f0c01FMSr0rmv1aOb0aVWpkSQeY1whr6pI7A3L7wDLZHLJDwVzjs4t9RJdWs7eE1XVL7uk6lKOkirrmrewJPwiLiJQeyRq9H8Up3k&cid=CAASEuRo4Z9mzxHacRidTm0R0mlwPA&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ccc69f5b0256bea3dee2929cdbcb3f9a4c859ab7d1df0e57c1cf46292911d25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13689
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7EC2 0
0 28ms
28ms Fetch
text/html 172.253.120.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CfQJJek49Yf7YENL8gQeeyZawA9DruvJk-672o-YN8C4QASD1tPUdYMkGoAHEm9O5AcgBBagDAcgDmwSqBM0BT9Bny9TZnZ3Czjb8-pIa2wVoV6yoeSttGEh6DkxANtmZzb4cm5zHlhl7mnGBFum9u8BA7L69jXDIUMQgjGTAk6AOgamUL-GpFee_jDDlwg7PvPZTQXVKq8qT9a9o-Qgyjy6lHCCDwU_cEtAiAbU1_ONq0J9dv42luOshWUJGbHZSGNbyExhDhAasgLyld_rQfqiCAeapBYB1NPQQZRM3jDOyw0wAZ5k-y1MlE4x79y-sHwGH2RjotQTaV7Yu7tYlc59JdSoSsb5EMncMEsAElNfAi8wD4AQDiAWa14yjMJIFBggDEAEYAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHpOSsxgKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcA8gcKEJqHQhiC98qnAdIIBwiAYRABGB-ACgHICwGwE_rRvwzIE9io7twD0BMA2BMNiBQE2BQB0BUBgBcBshccChoIABIUcHViLTk4NzA0OTk2MzgzMjM4MjkYAA&sigh=vw-KicKCmvY&cid=CAQSPACNIrLM19z8hqjFpBSJ9xVLVHBQtpeh-r0s3-ye48EBeRpiuWB4Sf51AHInOfVTKOrUrbxdFy1628Fn1w&vt=10

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.120.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 844A 1 KB
749 B 29ms
29ms Document
text/html 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 05:09:05 GMT
expires: Sun, 12 Sep 2021 05:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 70793
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7EC2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bcf1fa71a59f1c34204cf6c876577714dda498697eb109deff34f7751c458824

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 99BB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1

43 B
1014 B

69ms
23ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD99gIQ2O7--gEYyYL3fTAB&v=APEucNXA9A5PPLBUfLzBKoJyWRIGSSWAXMFvwsh8qo74K5N-v327qykmYYlf3fDgjAFFqatqaH0URqAxR1TPzQcVhPPeO5VKjw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 12 Sep 2021 00:48:59 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 12 Sep 2021 00:48:59 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 99BB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YT1OeosUIW3h-d-0Hc3ekQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD99gIQ2O7--gEYyYL3fTAB&v=APEucNXA9A5PPLBUfLzBKoJyWRIGSSWAXMFvwsh8qo74K5N-v327qykmYYlf3fDgjAFFqatqaH0URqAxR1TPzQcVhPPeO5VKjw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 12 Sep 2021 00:48:59 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 12 Sep 2021 00:48:59 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF_xaG0WzxcdnCFBV46TIHg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 99BB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELF7w0kVAqDZY3vKTMNJfa8&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELF7w0kVAqDZY3vKTMNJfa8%26google_cver%3D1

43 B
1 KB

23ms
23ms

Image
image/gif

185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELF7w0kVAqDZY3vKTMNJfa8%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD99gIQ2O7--gEYyYL3fTAB&v=APEucNXA9A5PPLBUfLzBKoJyWRIGSSWAXMFvwsh8qo74K5N-v327qykmYYlf3fDgjAFFqatqaH0URqAxR1TPzQcVhPPeO5VKjw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 12 Sep 2021 00:48:59 GMT
X-Proxy-Origin: 216.131.114.222; 216.131.114.222; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b0eaa993-8b4a-4c6d-8b24-b1cb5adf7de1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 12 Sep 2021 00:48:59 GMT
X-Proxy-Origin: 216.131.114.222; 216.131.114.222; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: da4f1b05-d0b6-443f-b882-f51943144b94
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELF7w0kVAqDZY3vKTMNJfa8%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 99BB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDY3MDQ1ODYyNzY0MzUyNzAwNQ%3D%3D

170 B
188 B

30ms
29ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDY3MDQ1ODYyNzY0MzUyNzAwNQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 12 Sep 2021 00:48:59 GMT
X-Proxy-Origin: 216.131.114.222; 216.131.114.222; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3ab8ce99-725b-44ec-a769-b4ad64533f27
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDY3MDQ1ODYyNzY0MzUyNzAwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 4867 169 KB
59 KB 128ms
30ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 10:07:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52862
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Sep 2021 10:07:57 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/elements/html/ Frame 4867 8 KB
3 KB 28ms
27ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B8ZriNMJowdTqRjXGDnjxlLEJiW1aGyClCrgDxW9dvlgxwGWulNJr9sQZ1g5H_Rmk7LIBUVHsZ99qa2c6zAFjzID93_xIsZnh2Day_HyCyCRmTfg882tgM_Eh9J_qCxpfErsSD-T4dPFdOIZrnBebDa5vIaw&dbm_d=AKAmf-COm_gP6yCWMYRxjefoNg6AcWkam-XDXnf59u3hikj_Kevcvl_jTNWlYKzUMYK0U5v1xGy_eO8Cr4_MuoP6Wvz4KIHu-JPfPimFsNLb5b5kdJhHUStjx234X_QCs5_7Ierm1pkEHOQyiMFCgFAGyCz6ZptB5SyR9NCdQUfQbX0zmPcn8V_9VM0kxE2nOS3F2LqeSXiOMn1mk9ovQ_xAXm5W1Tmkq75loVOlz5xdDpZkVbtRVI7UjQtlm6wUKKjEzliBrpDLiXcwI8h2Lao4qHsvA3NWYWUiMkFViDX2MnrnMFxRA8sTm-BBT0dXxwsEZhaHd-ZToWF4JrYjpIfBPXMex19FycvdjnXg2AyGjRNKIu6iF1sRYTKSxudpKmaCO1henpwKSxTDdRBmCxo3ZOVby6nQIroecxo9BdI3pn42NHHJBWc-MbCzgwZXgBkM6jCaFenvtmw-uhP_jC3_B0M7j1y4EXYPohFRWEEy6UzzTIhOWEpyI9s8pMosBorLQ8OflQaezi7nSxZ_YuktejtwRGvkuX3V3QOL5ElEjR3kZ5FjIGAqkmBLOretqRQ933BrPCd7MW4MZ5pd5EGpOk6K0hZ--Pb5N8MLQEjb-8UGVhYksoUaZsPRtJpsVxQBn5qLw1hHie-Dz_qZsXD5fM45SfA810uEVYkusMNqTMOCyDVd8W-F18b4i_q7D55fld_rBorgIuPKIKvVl4AhWUb79-PA1whf-LdlTSZhfKXWy3Qh1ObgEvyfm3nfi-mIOxLDVfHjZG4DRaQKP_NQnR49ZpmG7kgRezk8vKWsfUlhpgCP4MBFg70CEuG1oW-IBTzrALt1GYxrZtY4_9UMO869h1Z8tSnVENi1AUWK9SeqHWxepM8uc4aWn_qSOnxYYZxz9pCpLtXPSgX1svqBFNM7NLLSSWQIcvPbX_rnXc6kDmCCHvEp-av6oDU7OdAXkueirQGSW7XhZ5KFw08M96VTMKcnxuieWrIvb1GTQwsi4-IO_RLhNEnoeCUE4caASohdwOk1Ph11Ty47PavSgzWraL-FKMIlyLLdlPRdmELEyqexyf4CxeixAOam4xz3Y4N-h8G70RR34h9T_FWZWC0RTtMJCw7jy16jz6nsjCEjpG-gjXq2bH7GBRp_NdCfDYjKzOS9klF2tWIQJsdWW_9EYAQFmh2HpvQI8pvbhkNRV1djnQgHSnhIa3bS_SOHsQb5VFK3T7oBqxHT77SPrgsDw8XtZMg5smWD-U3X8J72_NvO-nYMf1nIebJ0IJxUt-UtqVeBSX1ZCgRiHqMBuXQKej5DmfpKIfkgf-Qcfmlr7PEW_yTVIwb_QHj9aSrRFzSx7ir-GVYvIdDC3_wKhw2F02yRl9r_gOWOGChhb5oneqv-Y6j0lieZufDDlKeF4g8nHqgiUy9v686eKZNHRxcTPKFdchw0mgE2Y0cDdDrIqQpoAK2tWRQQEwRWjCH2mPrUJM3pgkNPfGz5wTYpNlxyKwgbDIZCq0OmF89wfmW6hWNDgF87poGs7l46tkwGkW2LaKVn8u5hkCX_mMOuib6HUTrB3HJ1lPD0t_bP3jG1DVajWIee69Kcmv7goYgni6JbBsCW7ml8WypK-pM8rkJ2AXLlz21ZA71SgnU6Y5fp-QY5z9Q6lf9hRhYBttM0nT5vlG1W0-STICXenxg5Mp33o17_B425NjKslZaOjRknB3jwIdrkmEOPjD0dvLeDat7qgJvPGGiyg4_Am_mGckEoJCtsjypIsB-xO9MEpzOcJFS8mYQ06gpRuUZVsfrNllKHcCaaBojI35Y74OC-RQ9nydItqalgZgFnCPYCYUwdQt1QejjTOZ-HbnjDlctmi1utu4mIyj2MWAuPQMiB6gGYW3lzrKIe2Cb_-8eU6iZI8_I9q_Dy3birtH5-n4-JiSjupbaQkXSsr9CuEykF_GtF7QLuJbQD5sVZzea-RKNYshGucr6zSUA-Ob705X4idvkkdZWUanzL0mwsJTabBcXWQyAVVC-jkYEF3w7A3lnRUqAjHBkKNy6toIa45r-s5FY4eB2S2Jm-ClLWLk-mZsyPl6sbGjq8H-NJRsrSCQsZvknteKsvMgdewaIaY_2uGJHIOuBCpbK3y6rW2wUCLaAXn5fWACU-iBSEK0KeTsOCcFH5RBwi1wp0DbY91YAatm-A-pNEmnQg8YGjCHHXFaCMRFU_SOYaf9pV39TsOzlQy6eG69Vc4udXyawRgBpvJLa7CNgWrtmRnRzt9JIn4o3iVQfUHD_jr0cxSILsodGIeZWfQWCE1Z47Dy_yofL3AvcsySclnjlL08-elS7ubs1FVlhpwxwkUdxmVn_GPBaF8PoHSGaxXkmtg9Zp6s_4x0G7vIVg7hC3xQwj3bGPGEus-IFhjaqFKJHpyaP1wlE-VqpOBAFpzSTefwSYla_0MQuuoaFWrFk3jEEBJX9zd4SCoupov7Yd264W_K-F8aAZ3ZzVHSSlaDL14JtVbHtwSkzHaApn-hr8FKyibZTScdrL14kRbUXB430vCfJrHoy6bHYAGYqXVc--8guLEDDbEmQFkQTG9xejWHE7q4H4l0FsJpt2p4HDcorjs01IQZviVNZ8ootBmIuj-WDPx-CgjfOIDNKWD8QDZiLzQkzZJng8uSTrWWSCCgqlE8KrqyAHBFmppnRK0AWMZcA2FTZg25Iv6WmrYKYVtgEn7BzlQEWEcO-ri2V0YppjEpv-l7eqM_JWkW94ExyHlh5gy6Buev8NEuMiNSbGWw0c18ogRzhcV4KH5LVwSWCaEFGwR_bzSjAjBYJvo3J06Br4NJEzl_7L_oRf8UOoEQZLDq_7HPC5TtJQldYWzwFOxQ40HsmSc0fYq1_gzpY96WS907WCbnso_fUgVKkI_mDlpnENNHNSYBAdk8d_FG85rOBYC2VRvDGt7IxopLg5G0btIrvMxh0flMC6&cid=CAASEuRo7-4gtQCBSUbhDFS7ncENgA&rfl=2%2Chttps%253A%252F%252Fcredits-online.kz%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 18:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23577
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 25 Sep 2021 18:16:01 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/ Frame 4867 23 KB
9 KB 28ms
28ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210908/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f19df5f3569b83172adf37e884e0e4add74a23c3e057cf60336a1fddcb87ab79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2610
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9258
x-xss-protection: 0
server: cafe
etag: 9058358164849487988
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Sep 2021 00:05:28 GMT

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 54D4 35 KB
13 KB 30ms
29ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353360
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 8EAF 35 KB
13 KB 31ms
31ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353360
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 844A
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMXKKXtzWzrWcNO7SJkGhcY&google_cver=1&google_push=AYg5qPJh7kbzrBmgEQMsnzT-csGWEPJAb0ftlCwOgVBUMcWrsxJmqspQrV...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJh7kbzrBmgEQMsnzT-csGWEPJAb0ftlCwOgVBUMcWrsxJmqspQrVJZDhwIDhVcGhvPqV0UxsiU4UlMk0WG8SBT3QT3d2HL&google_hm=lDybnH...

170 B
188 B

28ms
28ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJh7kbzrBmgEQMsnzT-csGWEPJAb0ftlCwOgVBUMcWrsxJmqspQrVJZDhwIDhVcGhvPqV0UxsiU4UlMk0WG8SBT3QT3d2HL&google_hm=lDybnH8yQ5oJnDfYxFiRYw

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJh7kbzrBmgEQMsnzT-csGWEPJAb0ftlCwOgVBUMcWrsxJmqspQrVJZDhwIDhVcGhvPqV0UxsiU4UlMk0WG8SBT3QT3d2HL&google_hm=lDybnH8yQ5oJnDfYxFiRYw
pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 844A
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPL1zD7jwc1V8frYcj0zkC3kTVqZUo6mif1Oerq...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCSE1SUWdrMw&google_push=AYg5qPL1zD7jwc1V8frYcj0zkC3kTVqZUo6mif1Oerq95tMhlGxys43pWi-fj5YXWilaETB9QdqfajZnbawJMgRZ_fui8MK6mqQ

170 B
188 B

43ms
43ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCSE1SUWdrMw&google_push=AYg5qPL1zD7jwc1V8frYcj0zkC3kTVqZUo6mif1Oerq95tMhlGxys43pWi-fj5YXWilaETB9QdqfajZnbawJMgRZ_fui8MK6mqQ

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCSE1SUWdrMw&google_push=AYg5qPL1zD7jwc1V8frYcj0zkC3kTVqZUo6mif1Oerq95tMhlGxys43pWi-fj5YXWilaETB9QdqfajZnbawJMgRZ_fui8MK6mqQ
Date: Sun, 12 Sep 2021 00:48:59 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 844A
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPLwwfe1v6BNvp2SDpt3xYIs0HXjsHlJFtYFNPlFmyEKpydZ99VMRltgMqsEmMk2XXVn8K_sff6kl0XK1Gt...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=cSA-YnCHY3LgxrkyE_d6cY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPLwwfe1v6BNvp2SDpt3xYIs0HXjsHlJ...

170 B
188 B

48ms
48ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=cSA-YnCHY3LgxrkyE_d6cY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPLwwfe1v6BNvp2SDpt3xYIs0HXjsHlJFtYFNPlFmyEKpydZ99VMRltgMqsEmMk2XXVn8K_sff6kl0XK1GtfokovphP9xL9g

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=7884000; includeSubDomains
via: HTTP/2.0 odnd
last-modified: Fri, 03 Sep 2021 11:24:13 GMT
date: Sun, 12 Sep 2021 00:48:59 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=cSA-YnCHY3LgxrkyE_d6cY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPLwwfe1v6BNvp2SDpt3xYIs0HXjsHlJFtYFNPlFmyEKpydZ99VMRltgMqsEmMk2XXVn8K_sff6kl0XK1GtfokovphP9xL9g
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 844A
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLzoat1...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLzoat1...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA5MTIwMDQ4NTkwMDAxNjc3Mzc0NTgxOA%3D%3D&google_push=AYg5qPLzoat17gV3HC6sLcYDflFwlkIZdEhwJLcjxSfdG_r1EKyHejsvkhYKTfc9rSiwsw...

170 B
188 B

54ms
53ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA5MTIwMDQ4NTkwMDAxNjc3Mzc0NTgxOA%3D%3D&google_push=AYg5qPLzoat17gV3HC6sLcYDflFwlkIZdEhwJLcjxSfdG_r1EKyHejsvkhYKTfc9rSiwswxCmhDNgd0rUPrjqOPa9tYyu-Qmg3Q

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA5MTIwMDQ4NTkwMDAxNjc3Mzc0NTgxOA%3D%3D&google_push=AYg5qPLzoat17gV3HC6sLcYDflFwlkIZdEhwJLcjxSfdG_r1EKyHejsvkhYKTfc9rSiwswxCmhDNgd0rUPrjqOPa9tYyu-Qmg3Q
pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Sun, 12 Sep 2021 00:48:59 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 844A 43 B
388 B 24ms
22ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEAkqSdLh8Hder4_kwX0DhWs&google_cver=1&google_push=AYg5qPJKh1oGBZ-EeGGEWCLU7wtvNm3XXIyDZWF1cV3jlkhtnLlOOeUFxl0B-NTwJ99M552INlBIMYN3BklI8dGqmREKfWOep01v
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:58 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 trk
ag.innovid.com/ Frame 844A 43 B
295 B 99ms
30ms Image
image/gif 18.134.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEIrdJm0d0aCvA7nn_OcbRiA&google_cver=1&google_push=AYg5qPKC0EvxhwLMILhdq2dCcph3IY-mLkd7Mlwjf0b5NurYJYyADXvllov_iUc3Z9hFaM2XnotSGbcAVIwwuYLo1gvtC-5IWkN7
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.239.147 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-239-147.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 844A
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEDQ1c-T4Ws-YHLS2K12o7Zk&google_cver=1&google_push=AYg5qPK0bxCkMp9QznOuKWCZ...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK0bxCkMp9QznOuKWCZCXNA6FKFyPCgmSCBJAXwB_OA-sII0MWVy3FMCd7dtIuRVvbUKzsfdgrZti67GSXNCoPsr1vLdlaC&google_hm=

170 B
188 B

32ms
32ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK0bxCkMp9QznOuKWCZCXNA6FKFyPCgmSCBJAXwB_OA-sII0MWVy3FMCd7dtIuRVvbUKzsfdgrZti67GSXNCoPsr1vLdlaC&google_hm=

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK0bxCkMp9QznOuKWCZCXNA6FKFyPCgmSCBJAXwB_OA-sII0MWVy3FMCd7dtIuRVvbUKzsfdgrZti67GSXNCoPsr1vLdlaC&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sat, 11 Sep 2021 00:48:59 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 844A 0
12 B 24ms
23ms Image
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jp3Djylo_cKH8OizU-_ndUt2As6pBzvsf9112kxocftCC4vvia7bvXGdzuvQGtPPwFse_y5A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=280&adk=624704189&adf=2738030160&pi=t.aa~a.1135700519~i.1~rp.4&w=1108&fwrn=4&fwrnh=100&lmt=1568090122&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=6757429137&psa=0&ad_type=text_image&format=1108x280&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rh=200&rw=1107&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=-M&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280&nras=4&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=261&ady=4774&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=DzUK86c58Y&p=https%3A//credits-online.kz&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4867 41 KB
15 KB 21ms
21ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 14:47:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 468107
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Sep 2022 14:47:12 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 978B 1 KB
749 B 28ms
28ms Document
text/html 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 11 Sep 2021 05:09:05 GMT
expires: Sun, 12 Sep 2021 05:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 70794
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4867 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c09593bc9886275bae47490b69bde32946a834956d46a81b8030bd41746680c6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 7EC2 41 KB
15 KB 24ms
23ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210908_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 05:55:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 586421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 05 Sep 2022 05:55:18 GMT

HEAD
H3

200

https://gcdn.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

51ms
25ms

Fetch
video/mp4

74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/34E3A0094E7504423AC4BD3437B9179EC624E745.382B94BEE5ED42A1FC9F5D76DFBE2598D541FB19/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2213070
client-protocol: quic
last-modified: Mon, 03 May 2021 16:41:09 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: null
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: null
expires: Sun, 12 Sep 2021 00:48:59 GMT

Redirect headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 645
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/34E3A0094E7504423AC4BD3437B9179EC624E745.382B94BEE5ED42A1FC9F5D76DFBE2598D541FB19/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 16E9 22 KB
8 KB 23ms
22ms Document
text/html 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 06 Sep 2021 14:47:20 GMT
expires: Tue, 06 Sep 2022 14:47:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 468099
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 206 file.mp4
r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6B81 2 MB
2 MB 34ms
25ms Media
video/mp4 74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

3df6d5ffa6dc0792d4e8f8070f8f36e55b0045e0a9136effb2190f3e1641398a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2213069/2213070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2213070
expires: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Mon, 03 May 2021 16:41:09 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 0AC4 23 KB
9 KB 24ms
23ms Document
text/html 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8727
date: Fri, 10 Sep 2021 16:22:57 GMT
expires: Sat, 10 Sep 2022 16:22:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 116762
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 206 file.mp4
r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 4789 2 MB
2 MB 31ms
25ms Media
video/mp4 74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/699144644C2CE9B1C45D8A5DC9ECE4248BF3BA31.58F445BAFE9F7B6D43867FEA60C0C9BA0EF2AEF4/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

3df6d5ffa6dc0792d4e8f8070f8f36e55b0045e0a9136effb2190f3e1641398a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2213069/2213070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2213070
expires: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Mon, 03 May 2021 16:41:09 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 978B
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIYWIMyp0ENUHVYxbpf-RUpqzO2aEgvxHcQc7S...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCZW9ARjMtNw&google_push=AYg5qPIYWIMyp0ENUHVYxbpf-RUpqzO2aEgvxHcQc7SIzU_IGonPYrQuiJTHY69b14RXyHYHsuSC3NRhlGUOL_b2GlmTlsWVuWlA

170 B
188 B

41ms
41ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCZW9ARjMtNw&google_push=AYg5qPIYWIMyp0ENUHVYxbpf-RUpqzO2aEgvxHcQc7SIzU_IGonPYrQuiJTHY69b14RXyHYHsuSC3NRhlGUOL_b2GlmTlsWVuWlA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVQxT2V3QUFCZW9ARjMtNw&google_push=AYg5qPIYWIMyp0ENUHVYxbpf-RUpqzO2aEgvxHcQc7SIzU_IGonPYrQuiJTHY69b14RXyHYHsuSC3NRhlGUOL_b2GlmTlsWVuWlA
Date: Sun, 12 Sep 2021 00:48:59 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 978B 42 B
317 B 28ms
27ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLfnqyXOsD7jzSgpNUnASAfFukkNJt04Ia7N5Q5j4UZfNLh_sTHKmV6ufbqfcX5S1Qa0RgAOYtCEqbXU6aEqgbaE6DMEbQN&google_gid=CAESEJM_SypOroSsCHzU7sTKPao&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 978B
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIu3TpqDiF2IrCTtASMGjie1tQeuYHQlNXGRPsYZ_eQQ5X3bJIOt9xaSKZFYdk7fa6VTNLSKNVm3OfXoYH...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ZVpAPeD1e3RBbCVshOj0xY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIu3TpqDiF2IrCTtASMGjie1tQeuYHQ...

170 B
188 B

48ms
47ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ZVpAPeD1e3RBbCVshOj0xY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIu3TpqDiF2IrCTtASMGjie1tQeuYHQlNXGRPsYZ_eQQ5X3bJIOt9xaSKZFYdk7fa6VTNLSKNVm3OfXoYHwrCBUGU4Jzq2x

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=7884000; includeSubDomains
via: HTTP/2.0 odnd
last-modified: Fri, 03 Sep 2021 11:24:13 GMT
date: Sun, 12 Sep 2021 00:48:59 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=ZVpAPeD1e3RBbCVshOj0xY&tap=gAds&google_gid=CAESELQWBycL1wWMwrAUJ3d339s&google_cver=1&google_push=AYg5qPIu3TpqDiF2IrCTtASMGjie1tQeuYHQlNXGRPsYZ_eQQ5X3bJIOt9xaSKZFYdk7fa6VTNLSKNVm3OfXoYHwrCBUGU4Jzq2x
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 978B
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cNIVohbZQtWjLaXCr9PpoA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
48ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cNIVohbZQtWjLaXCr9PpoA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ8f5zAUxNipVdDjO262GUpWQAFnoAWNS21MhyFkQnoLlIHxNMIPmW8YQBpBJ9MXOCkFq2uMke2mEZeEgBElclR723UeXRk

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=cNIVohbZQtWjLaXCr9PpoA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ8f5zAUxNipVdDjO262GUpWQAFnoAWNS21MhyFkQnoLlIHxNMIPmW8YQBpBJ9MXOCkFq2uMke2mEZeEgBElclR723UeXRk
date: Sun, 12 Sep 2021 00:48:58 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 978B
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKjPuHbGRWFo2ki7yyUFO5I&google_cver=1&google_push=AYg5qPJpnOyjxyfxsxi6ke_YIn_iuq7EXQyhqwGwGefJyi-YUpH79Np9Yytd3lSN4yAb-GhNNat...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOVVMtNS1JV0NY&google_push=AYg5qPJpnOyjxyfxsxi6ke_YIn_iuq7EXQyhqwGwGefJyi-YUpH79Np9Yytd3lSN4yAb-GhNNatrsuowZvT-H4TY9BS6uGKrrxg3

170 B
188 B

29ms
28ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOVVMtNS1JV0NY&google_push=AYg5qPJpnOyjxyfxsxi6ke_YIn_iuq7EXQyhqwGwGefJyi-YUpH79Np9Yytd3lSN4yAb-GhNNatrsuowZvT-H4TY9BS6uGKrrxg3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RHSTFOVVMtNS1JV0NY&google_push=AYg5qPJpnOyjxyfxsxi6ke_YIn_iuq7EXQyhqwGwGefJyi-YUpH79Np9Yytd3lSN4yAb-GhNNatrsuowZvT-H4TY9BS6uGKrrxg3
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 978B
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEIrdJm0d0aCvA7nn_OcbRiA&google_cver=1&google_push=AYg5qPIMbWQMtTj0KzgdTcd9Gvs7WOzsgvlXZ8ONsEk11lozIcUI5HGi5M4aH9QQULvk2_nYPkaOpJIemHBft-PT519bjy8...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIMbWQMtTj0KzgdTcd9Gvs7WOzsgvlXZ8ONsEk11lozIcUI5HGi5M4aH9QQULvk2_nYPkaOpJIemHBft-PT519bjy8i_KQX&google_hm=9NTcoMsKS1KXDs0a...

170 B
188 B

32ms
32ms

Image
image/png

66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIMbWQMtTj0KzgdTcd9Gvs7WOzsgvlXZ8ONsEk11lozIcUI5HGi5M4aH9QQULvk2_nYPkaOpJIemHBft-PT519bjy8i_KQX&google_hm=9NTcoMsKS1KXDs0aJf1cOw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPIMbWQMtTj0KzgdTcd9Gvs7WOzsgvlXZ8ONsEk11lozIcUI5HGi5M4aH9QQULvk2_nYPkaOpJIemHBft-PT519bjy8i_KQX&google_hm=9NTcoMsKS1KXDs0aJf1cOw
pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 978B 0
12 B 26ms
25ms Image
text/html 66.102.1.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KyRtFIXukvqYAdMd7pQX9lU-WmLy_kcQqhYI4XDYPaPI7-RDMVHmYyGsUksQTR-A

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

66.102.1.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 206 file.mp4
r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 7EC2 2 MB
2 MB 36ms
36ms Media
video/mp4 74.125.13.231
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzs.c.2mdn.net/videoplayback/id/c2dfe4d1d82dd84b/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1662943738/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/34E3A0094E7504423AC4BD3437B9179EC624E745.382B94BEE5ED42A1FC9F5D76DFBE2598D541FB19/key/cms1/cms_redirect/yes/mh/sG/mip/216.131.114.222/mm/42/mn/sn-4g5e6nzs/ms/onc/mt/1631407481/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.13.231 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

3df6d5ffa6dc0792d4e8f8070f8f36e55b0045e0a9136effb2190f3e1641398a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Range: bytes=0-

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2213069/2213070
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2213070
expires: Sun, 12 Sep 2021 00:48:59 GMT
last-modified: Mon, 03 May 2021 16:41:09 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3

200

activityi;dc_pre=CM33obab-PICFUzO3godSOUEtw;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 Show response
10192510.fls.doubleclick.net/ Frame 4867
Redirect Chain

https://10192510.fls.doubleclick.net/activityi;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://10192510.fls.doubleclick.net/activityi;dc_pre=CM33obab-PICFUzO3godSOUEtw;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?

0
0

123ms
71ms

Script
text/html

108.177.15.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://10192510.fls.doubleclick.net/activityi;dc_pre=CM33obab-PICFUzO3godSOUEtw;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.177.15.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wr-in-f149.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
location: https://10192510.fls.doubleclick.net/activityi;dc_pre=CM33obab-PICFUzO3godSOUEtw;src=10192510;type=impressi;cat=lv-delve;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

activityi;dc_pre=CMv3obab-PICFb9A9ggdmI0AoA;src=10192510;type=impressi;cat=lv-rtbal;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1 Show response
10192510.fls.doubleclick.net/ Frame 4867
Redirect Chain

https://10192510.fls.doubleclick.net/activityi;src=10192510;type=impressi;cat=lv-rtbal;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1?
https://10192510.fls.doubleclick.net/activityi;dc_pre=CMv3obab-PICFb9A9ggdmI0AoA;src=10192510;type=impressi;cat=lv-rtbal;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_con...

0
0

123ms
70ms

Script
text/html

108.177.15.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://10192510.fls.doubleclick.net/activityi;dc_pre=CMv3obab-PICFb9A9ggdmI0AoA;src=10192510;type=impressi;cat=lv-rtbal;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1?
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9870499638323829&output=html&h=90&adk=234195445&adf=3978507135&pi=t.aa~a.2696207822~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1568090122&rafmt=1&to=qs&pwprc=6757429137&psa=0&format=1200x90&url=https%3A%2F%2Fcredits-online.kz%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631407738230&bpp=1&bdt=2670&idt=1&shv=r20210908&mjsv=m202109080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc278609378e168d9-22e809c7f1ca00c1%3AT%3D1631407737%3ART%3D1631407737%3AS%3DALNI_MbUqRfzYLO-2TztToOD_TK8Ro7avg&prev_fmts=0x0%2C1128x280%2C1136x280%2C1108x280%2C1108x280%2C1108x280%2C1200x280&nras=7&correlator=6708965214129&frm=20&pv=1&ga_vid=373990710.1631407738&ga_sid=1631407738&ga_hid=79909503&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=200&ady=2378&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062492%2C31062297%2C31062311&oid=3&pvsid=3372672236767567&pem=419&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=ujkTAUSeHI&p=https%3A//credits-online.kz&dtd=29
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.177.15.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wr-in-f149.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
location: https://10192510.fls.doubleclick.net/activityi;dc_pre=CMv3obab-PICFb9A9ggdmI0AoA;src=10192510;type=impressi;cat=lv-rtbal;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 22 KB
9 KB 67ms
37ms Document
text/html 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c906264e77d8929b3c5998d23bee3374634c8d5cd7c85a53ffc0ca10eac5a091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8705
date: Sun, 12 Sep 2021 00:48:59 GMT
expires: Mon, 13 Sep 2021 00:48:59 GMT
cache-control: public, max-age=86400
last-modified: Wed, 05 May 2021 09:55:08 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4867 0
592 B 153ms
51ms Ping
image/gif 74.125.133.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvw8J6t5x0bPUHIqjgZyFjuBJGIu2VjeK6homcZDtdc_zYUFAQiIbfjoOyJnWLvdu9feP8n_V_DiV_4zH4Fp_o8bJR5YHjtfQCDBsq_TIIjlUOVx1fNJgp6CuwZaDOs8L6gSg2b5lKFFwH0oJG4XulsIusZXIh6MCDPpkE1W5K5sg1yvHZufUxmojMphGWQ9EKolVBGf1I400WBB8NqfR1b9EJ3k47oEypC2Bd5DGhrmGTfdDgSlJhQEiV2dKzPLIQ09RbGc0BAPmJ9oyAt8R_gh3IjbZ1kPGxbJtvZeUzO-5xMw5GRszuAXOFtJcIj2DyE_JKmsxM0FB3cPugcz7D7jB1554EuznGghcnSYLE2hQzgikWxmPB4Hvh7gqXMPpVsE5IlQC77vlCmE2Dt_ovif4q2EMi1qL11potv3v8hVQ89F_rmT_p6PEANidmr6UnuaRTKSIYe4vR_BzS-wn4Lr5V92tAwNj2xtvRiXa5qJl9F5WGuSe1zDxgxU0jetEfWZLWYOqfSD3j6ZU_7uowLiAPP1iT9vxkcuW6vvHCHIt6alg_aM5b3UucY-ObKs-t8raNYn5itpQ1gIIdXqaeYRAa6xOQjOhQwuvEo5kn2yov-kGAwOzfWCA4tbWwRwSXqLqXdfZEZmFxNeiU5n42AQiDAiX_NoVDgZgfR45XNW8HM4dc09d5IHG-ZecMGNNCXzDrkzOvSjhQ24NK77ey67xe3hKMOY51z0TrcL_e_j4q0JPVjBD_H8pzFb1gwsKaPpPGDytfIloKqFz9mZlSN02XDmhAqgxQMRPDKKhY72ywTOrf78kGe94iuRg0mpCjmmV6HEg7A6sB5dUYZMVHXMS0YmhaNMpWXm97qvCkHAsV1jqlHOO8iKqpakj-1NmsGR2vW5VsPGVFNJgpdmEMOborQyL6R6p3L5vw1yLaDyz2K2w5HQKGXGE9K0ax0qOkZLfhBiByFDYX8pLwT1mEN--TX4Yaf5DwwGrnoHU0epchM0-6Pwhj1d0uUf2hxfzzVGGbHH9Lf5-BJ7lzood7WtxiOvyr1zs2wnVXjruBRGZ2I_9VadFBCj3QMgUzBLcRJz1cl6gUqbAz2zOhMeeMczXl-B9Vj9V_3di4ncf8VL_kp&sai=AMfl-YTPLjFWmMpI9M1vSqii-7cwgUvWH8V0r2iiJqdNrc7Bk9hg-z3GuA_-hrGHsf3FrL7aYDFrsKU1uq8xB1AOp84QADgqSA1PGoHW73Nv-yR130n4iLjeAM2_PYzhCBhAcZJX5n2pNxpv7BGmS5iCHV76QZp8CA&sig=Cg0ArKJSzK5oqSArLpd9EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=225&cbvp=1&cstd=220&cisv=r20210908.26656&adurl=

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 12 Sep 2021 00:48:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 16E9 35 KB
13 KB 37ms
37ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 0AC4 35 KB
13 KB 44ms
44ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 initial.css
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 4 KB
1 KB 57ms
57ms Stylesheet
text/css 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61caa208368008a010f3007e144470a9ffa69b2a7ec1aa61f740bb04b3806287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1104
x-xss-protection: 0
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Sep 2021 00:48:59 GMT

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 981E 110 KB
38 KB 44ms
43ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 18:53:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21327
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Sep 2021 18:53:32 GMT

GET
H3 200 modernizr.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 3 KB
1 KB 48ms
48ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/modernizr.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f02e1ddd474fd249cee6c56e4f1a491ac825f8f82dd8892817c4ff8079056a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1424
x-xss-protection: 0
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Sep 2021 00:48:59 GMT

GET
H3 200 DrawSVGPlugin.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 4 KB
2 KB 60ms
60ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/DrawSVGPlugin.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c951ef5c0fb339a2cb574510f4c0a4393e1af0c7af599eb1d85ce771bdc32d5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2126
x-xss-protection: 0
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Sep 2021 00:48:59 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 981E 60 KB
24 KB 45ms
45ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Sep 2021 00:48:59 GMT

GET
H3 200 initial.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 8 KB
2 KB 70ms
69ms Script
text/javascript 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e19938f830069c0aa267de588de14f550ad679e3118d1723bd0915259501317

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2263
x-xss-protection: 0
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 13 Sep 2021 00:48:59 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54D4 0
20 B 58ms
57ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BBeFvek49YbHmMZDHb7OwpOgJAAAAADgB4AQC&bg=!wMOlw4fNAAYT0U73E9E7ACkAdvg8Wg4votHW1R9efep3VMZmm8tbtSXUwSwlpp51QluuiwaMpjeTXAIAAADSUgAAADBoAQcKAF5W-jaFLbeyqxyOttB0aC-tla7gedXM-ffGxsokhgBBDWgkQcK_AkJ1YBbArd7k69CfdmN43gkNcBkn6-cQP6OnGpJ6fCwUtfuLFW_93nEarK9gDnKE18-wU_CLd7qmmQKnH27KBUnlH--0zU0iAtz7VhhL44s4SW7HY6admz__WYcDe8xavl_BypG54yq3IT_3qVYE3nqQlBuPfKGraoVDcb51a_Nuv77uhSrP6a0kN0KbVO_nbei1fqosIrWO55xk3_qLfSfe380k3fDGUKPUpgGRzGoPXwD9t-r8aUlaO0k-D1XY5_7_yjEJlyrQ2pWSbg2aEx0-99Q3iDqME9K3ezBms5O9eyxkXrdvzG1HHgZiG5Y4aVvSrNDhDQQjgS3lRfupgAvUqv4jsG8It6QEDFi0XKWpVxhaf5eqr8luAVqbSdXn2tmuYPwRwParbBdxJxwkR9N4sX4Qi28qXP0Dy52XtjJrPmsGG-l_Tpsr2n5_nu70p105RNpky8zyIOk87EmkEvp7g0Y98WWHi8TOsUj8rBhaOukNgeQrRloLyGhMIsicHSzkAl6EbCG7YCUH8I1BmVZZ70Ic4SaSXl0NALU9WFHd4asLnh8P7e4aR0xRmqmrUx5wLmSLFAZ0tXn8ptseLY0Q6fAjGerLkQXlNAxih4QiGGc5B599b7OBulLb4fWpaFdTyIbY0uUSTY7Nud3QB5ehkjaj3aOXDuEBuvxNS5L0ofF6SrYcLrELTqbW6pXa4p2dE6Wx6J7TBIzGeApS-EivvLOvsDUPoZ68a_-a4_IMnUMfLtIC_H49w8bM2S_NkJroH24fsSsnJt8z-mITvgUp0-Zz9TC3AwOgnO8Rlgagp7EXZy58OT8PpRKy4ioVFbKyrEqo53wSP5r2rPAXScYL6tRNt-eFiPxPW0nqAEhREReAj2Rt7lPNjgMQakasSKvAtwAAyLWVYDvs-_txXT82tYyWhlRyQlaI513-_f4E1nWutGE5Vm7XD6XYhxgW7yDytuoKmu49qf9cfm1Hv6S_9A

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8EAF 0
20 B 59ms
58ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BceFvek49YZ_ZMYiwzAaMmZHYBgAAAAA4AeAEAg&bg=!ra6lrurNAAYT0U73E9E7ACkAdvg8WrwOMPkaoFDYSAEA3lYCUZRusaY7jn40uoj2Ex4f7ZmVC664cgIAAADTUgAAAC1oAQeZAruSx6cILHgVuDCGzB999upEBhDGv1yL2L2wGHJ2zFuGN4mDmg-6l1PjjuntA7pQ0Bzna000Tk4Qk5Z9mhAnI8ygI-A44f1T7C4exKEVLfbwTJqsNbneVfrKg3oJzbXlrhaRp6_oyqgtO6tC02oACba-J2SdcQJgYaSl9uMvvsu3NMfcowZ7JdapAR_indAN_crua4oR0jG7N0AOPRR-mQxVzVWekvjVXgyY1z62aJoJEaM5NsNep5Nmawjb_OsQ3iC2VBDZKlrbZj1-LWSNaa0aXDhXomA6XQ8VayJen905_EcMkVCeAXX63U4TJfqaHeCQ14LX5qIssjmCkE8rpKGI9er-fVeU_bT0F70yE1gBx1uleKqJF8vA5imqoDxQhgyv8LM1l8t_W77RUSWBcOKzG8SeihwID4ajrOE08fTmGNp9w79WjJPhDSCJenN6Tpaz_PBpj2lAJcZCWFa0iGkNgjs3yheDehH2EUBA2jxgcQytPLKvbhkgEchcFR4xMeayYLsqYEkKKYPmmmbfOESwXu4Xc1ys8JYGbHwv6jWGESVrGqjbskdvzohGRHwVEv7ce2dBm1W3aCYt6_O6u7sE5qCtm4nFNrN2a30IE9BFoSiGl_xc7tARF0oJWziyedmJmgBlU5DUccn4cRMJDC7HQdcsBW3Gp8g6b4iqrK-54mIcRPK2EYcUAnsjmv5O_Ggp108cSuKH_r-b7bssa1L1zupUzHKEIiEXq29Zrl8HwmVE_hRx0rRMa0UOuZYJ8YEim5s0iyqXsUXWf3r2E4VD6UHuDS50cBC6TbATYNhdzTQuZvlu9w24RP8dYliMhC-pv2Du1w0CghBAMaR624GvWnASIEshXIG8FbrTphqDLkt78SlqgR8AEAsNJDg2jEs8H_tNX6vIdYlc9LHqqAFCu4ZeNwyudEjb5Hs

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EE1C 42 B
64 B 55ms
54ms Fetch
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstk9xTQA5xH6kyJlizHJlajOWKMaYtvdZCrihsi08O0pHXpDieFRW9A1yjwIWsXywhAGyfzN_ZYhj0t7CS33nXefSgBbURJXZSCAW7kg4bgr_IIS7rkqyjc7pA&sai=AMfl-YQ5DKd2GKE4Xw5nZT8mE5mhXgshCCvg4WNFKIh645bGZuXyrOMLlp5Xts-3lCHoLCiMWsxMSVze4UC6&sig=Cg0ArKJSzMp3lQMdPYRNEAE&id=lidar2&mcvt=1016&p=510,236,790,1364&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20210910&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=651642478&rs=2&met=mue&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1631407737570&rpt=765&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 981E 6 KB
4 KB 52ms
51ms XHR
application/json 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47105eda6b33b9c7339c06eef49343df55667e7b899b993394231486b2b84f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4533
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4867 0
23 B 110ms
53ms Ping
image/gif 74.125.133.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: credits-online.kz
URL: https://credits-online.kz/

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.133.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f155.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 uc-id=185-afB5cQJrot-Xfa6pIWuEN3xRQBGZL_1620127061752_uc.jpeg
s0.2mdn.net/dynamic/2/10802576/drive.google.com/ Frame 981E 322 KB
322 KB 68ms
68ms Image
image/jpeg 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10802576/drive.google.com/uc-id=185-afB5cQJrot-Xfa6pIWuEN3xRQBGZL_1620127061752_uc.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

424f0bd3b66b36c577850d57d8c4105480adad92ab64bdf5c0e2656db9c84352

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 13:41:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 04 May 2021 11:17:43 GMT
server: sffe
age: 40021
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329577
x-xss-protection: 0
expires: Sun, 11 Sep 2022 13:41:58 GMT

GET
H3 200 uc-id=1MrMDoj5DfyNGa84fvl2Z73u6M8gqNbgp_1620127061752_uc.jpeg
s0.2mdn.net/dynamic/2/10802576/drive.google.com/ Frame 981E 146 KB
146 KB 49ms
49ms Image
image/jpeg 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10802576/drive.google.com/uc-id=1MrMDoj5DfyNGa84fvl2Z73u6M8gqNbgp_1620127061752_uc.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0a1dcd8a2d1bdc503eafac2bac53882352bc1e27f0dea30789f36e4c4ec495

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 05 Sep 2021 18:19:55 GMT
x-content-type-options: nosniff
last-modified: Tue, 04 May 2021 11:17:43 GMT
server: sffe
age: 541744
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 149370
x-xss-protection: 0
expires: Mon, 05 Sep 2022 18:19:55 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 16E9 0
20 B 62ms
61ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6yu_ek49YcSEN_HJnsEP3MCHsAoAAAAAOAHgBAI&bg=!GxilGFzNAAYT0U73E9E7ACkAdvg8Wvviwn7uuQQr-NQNY0tO95SvxbC7z3HtPQptFHMzTxw9MLQuSgIAAAC-UgAAABRoAQcKAKXDoGImz4IjVjw3Wg1B5QIAWcWr0bh19ZM1vwfJVTt25xB8XwRqrt8cwI2q6AZyW6_1btRmixseEXWimpq3TaZkj_m1GhdaPWSRqrkYFKWBCadwgekEDf0nbavIc-ELCHLqhqRzYtaQqsxia0sQE1greL0ZHHzzjjGaw1ZOPBcQZwrQafiZFGKR05XOTxBH2UzwGLf0f0ej4801MYWvCkpSAsAapkqZAtP9qZW0VNaPvcWkPFjfbzT139LDimZAdIcr03ZpTJx4N6PXMmrXF9TmXqxHrP6KGAe0P5lA2KCgjh9ZAgTApqXTE6d08-UJlIIfWfYFDvb64X_swdGMQoiBluVbUOF3HyDKBPRLeup8tD5C1t69Mbf1EhTuCNGR9IpKRtDviIy-fbYpLNYdwD3P_6AVTXT242VpIJIH-ufeBBWUeJ62M6vIuxhZsdm3NqSo3ZRvC-4vJ0Cn-5Mqc9XAwqzdkuy0EXgzpzX6KKzjJs42gKHPP7KUKNEUMd6CGzosAQY9uQ4pqAzBdnSipLpS8U9FhV-0WbXKMlh3k68VFLDTKFPJojRSvB7yDngY0ygl4df-07s7zI2hDsHPE4gPs7yQkvopZol3JWJ_i_DORbNcSOEVnpk9ugmUJXs1e_2ZkYZv3c-pRnQx0yx1VX6xHxGdBSXyZq1W6Y0R0LyeRA_dHdd-qzcrRWyXc_eV-a3Xf3RLNP9MXWirt_th3VQaEs5Zy_8EWJK5onLN3RcQh1wg2_gOw4xZ3F2NerkCZaCGFgLG_0lVmX8VurytOX2OaAC80BgBBnjOo9Prh4RHy17jxulwjFkcuKSrYN1o_LLhiT5JX25VtOLRTxuYn2Q3NjLOLwWQx0EGkfsSupwsHI_ZVUwqkbxPGJyebFh4XCAmdnbHlUbUCwDw8W2dlC6UzQffJifwPJk2-EiknxWupVJ0y0fmyfwNHTumcxtsSyGQTfbjZ66yiQZSvVNfk8ARBSwOekdzImz5wCG3eXGSekF2Pri-o8-kWGZkw0FGb3ijDJ5ArOeUPDDGKgkm-GmcalWkBD27AoCuKhpjaXzahhvxy42oOjfzAvbPPmZD3OAKpbdR9IlerdqEUUqNfrbAiMZxCvEjqBDKFgYkgItev0TuGE9uyXk7iy_d7j4IecKTBPSGxEfna9SRilu47-5RgqQRNzs_ZpnqOaA

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0AC4 0
20 B 62ms
61ms Image
image/gif 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BCnChek49YYmSOuyhmLAPyNSwqA0AAAAAOAHgBAI&bg=!iIuli8_NAAYT0U73E9E7ACkAdvg8WgxkW16u1fwFQtZOw2Xp2xCeFqXJp2oi92lNT8tqAsMqotphuwIAAACnUgAAAAloAQcKALurH7iLDHXVMxPU968rHOCnzYkVHvuF5NUuUXHcfUuzAzMd2O-b-LnvIdBXFih0sJsf1UCdn3YmlKPbNtHO6MwiUw-YBqAPwavQE5FJxme_wVz4Y3Nnh4RcGHqCNurKtorPHiA8tBmKbXWlKmajaO13f7bvA8fzoM00gHRXFMe6hm9xIYeIFiTaJ5CXxnhFjkIu0GT8e6wn8B5Kt2z7XNl15Cr2bMMN_bc5-obH52z1JZyYTbCbAf1UQcSRmQK9IqPFqHCQUCOdbyHg5oanH0ihmrwnxGtv4Xd-gf6bGyikY5K1KaoduAf5Cf3BB6zFVz3lSCN51wUlX1Lw_q-2Ln9ZFDlGNOnWi4YW4UBwmhwrP0BPBtOi0E2_s7vmOr4xHnlnrawRPGLb2J2C4b0wmHdvNy3xgk36qXcqZr6UBz3Uhz5jtjqXC8AWZe23qutt2SZWrssYVR2gVvse9sYrS6j8voqsCbJH57SUthE0E2db27zZ-mH-tRtC8YQ97yTNOU63xpgvIId-H9-RAi3Ko3SnE9KfN215dUBGTqp55LFwTVAK34e0ybXRMXLX2bUVrfk-QPnU7Z6oUdelh9oFBBMpiOrYpYFU3OfPfwfSLrX_k94iJPsjfR4YCpCDBoF4EyQQYr0OTsGdieNmOKWWwaufJpQ2IrSQNbHtkhQPnDqy_AFGNpvVAt1VR_7f6nz4RPsWK5MfMm7FYSQf7AdkWcnECjBIDu057rlVPgnXOAO5syJN9qDPDvZPfdEO5tCp9LpVGBEHd1-lOn2XMSaEA76mBkTyiPOg6LclIYMU8bUU7gjpWxbXEPWnwZMQM7ELxxSKb9OQJhPoRMn15Wh0nqrYTa5e0BHgWfyBgCBKJy9o6ZQP9kH8GS_yJPuBUQxag18xzVg7hnASKplw0B3iNGXNbQPfWwLflMa_FWvrEvauY-0YxeGRPS_cNGbv8JrGyk50qiMRWd-PY-d7dY5Aqvs0eIPtnqn1gfrQUywQaR5oXQ0VkBoKa9mjY3LmRxJX4ksa1bRxdtZsw5992JsmLuMlXBunZv943R9K5Cfh90spH2IKObjPxQYn46Ptejgqae9H_QloBpoiFKWq8hiATA3SQL72ZFuW_-QUA0ykFz4ayOHeaVbJBuvyC0m1UhOKOSDNejVg1QmwCxxTEicc64oH41q0N2xmpHYLYkE

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Sep 2021 00:48:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 981E 17 KB
6 KB 54ms
53ms Script
text/javascript 74.125.206.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.206.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 00:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 12 Sep 2021 00:48:59 GMT

GET
H3 200 FoundersGrotesk-Medium.woff2
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 18 KB
19 KB 44ms
43ms Font
font/woff2 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/FoundersGrotesk-Medium.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.css

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6eeed3cddf399beca9546ab276ca954509f6c73fda6998259d10c422fc8e1e58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 14:37:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
age: 36662
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18940
x-xss-protection: 0
expires: Sun, 12 Sep 2021 14:37:57 GMT

GET
H3 200 Monday-Regular.woff2
s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/ Frame 981E 31 KB
31 KB 53ms
53ms Font
font/woff2 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/Monday-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.css

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

baf2d495f622427b286baab164a094028836de27aa52c52192029cfbd924c9dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/initial.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 14:37:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 05 May 2021 09:55:08 GMT
server: sffe
age: 36662
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31352
x-xss-protection: 0
expires: Sun, 12 Sep 2021 14:37:57 GMT

GET
H3 200 N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js Show response
pagead2.googlesyndication.com/bg/ Frame 3A69 35 KB
13 KB 51ms
51ms Script
text/javascript 142.251.5.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/N5eGun79KMNogHl3JXLjLo7C-VgSu6qtVH-zZQh4z98.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

379786ba7efd28c3688079772572e32e8ec2f95812bbaaad547fb3650878cfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 22:39:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13196
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 22:39:38 GMT

GET
H3 200 uc-id=185-afB5cQJrot-Xfa6pIWuEN3xRQBGZL_1620127061752_uc.jpeg
s0.2mdn.net/dynamic/2/10802576/drive.google.com/ Frame 981E 322 KB
322 KB 37ms
37ms Image
image/jpeg 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10802576/drive.google.com/uc-id=185-afB5cQJrot-Xfa6pIWuEN3xRQBGZL_1620127061752_uc.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

424f0bd3b66b36c577850d57d8c4105480adad92ab64bdf5c0e2656db9c84352

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61772725/20210505025508768/index.html?e=69&leftOffset=0&topOffset=0&c=ov0TvtVHA1&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 13:41:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 04 May 2021 11:17:43 GMT
server: sffe
age: 40021
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329577
x-xss-protection: 0
expires: Sun, 11 Sep 2022 13:41:58 GMT

GET
H3 200 uc-id=1MrMDoj5DfyNGa84fvl2Z73u6M8gqNbgp_1620127061752_uc.jpeg
s0.2mdn.net/dynamic/2/10802576/drive.google.com/ Frame 981E 146 KB
146 KB 40ms
39ms Image
image/jpeg 74.125.140.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10802576/drive.google.com/uc-id=1MrMDoj5DfyNGa84fvl2Z73u6M8gqNbgp_1620127061752_uc.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.140.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS