pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro
45.147.197.153 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Submission: On July 08 via api (July 8th 2023, 2:35:10 pm UTC) from US — Scanned from US

Summary HTTP 180 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 37 IPs in 5 countries across 42 domains to perform 180 HTTP transactions. The main IP is 45.147.197.153, located in Dronten, Netherlands and belongs to ON-LINE-DATA Server location - Netherlands, Dronten, NL. The main domain is pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru.
TLS certificate: Issued by R3 on June 8th 2023. Valid for: 3 months.

This is the only time pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	45.147.197.153 45.147.197.153	204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands)
2 12	2a02:6b8:20::215 2a02:6b8:20::215	208722 (GLOBAL_DC) (GLOBAL_DC)
1	77.88.55.60 77.88.55.60	13238 (YANDEX) (YANDEX)
1	2a02:6b8:a::a 2a02:6b8:a::a	208722 (GLOBAL_DC) (GLOBAL_DC)
5	2607:f8b0:400... 2607:f8b0:4006:824::2002	15169 (GOOGLE) (GOOGLE)
12	2606:4700:303... 2606:4700:3038::6815:e9df	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2607:f8b0:400... 2607:f8b0:4006:81c::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:6b8::16b 2a02:6b8::16b	208722 (GLOBAL_DC) (GLOBAL_DC)
1	96.46.183.20 96.46.183.20	7979 (SERVERS-COM) (SERVERS-COM)
1	2a00:1148:db0... 2a00:1148:db00::17	47764 (VK-AS) (VK-AS)
3	213.180.193.90 213.180.193.90	13238 (YANDEX) (YANDEX)
1 2	88.212.202.52 88.212.202.52	39134 (UNITEDNET) (UNITEDNET)
1	89.184.81.35 89.184.81.35	28907 (MIROHOST ...) (MIROHOST Web hosting)
1	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
3	2607:f8b0:400... 2607:f8b0:4006:80e::200e	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4006:80e::2002	15169 (GOOGLE) (GOOGLE)
9	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
10	2607:f8b0:400... 2607:f8b0:4006:821::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
1	2620:100:a001... 2620:100:a001::24	19750 (AS-CRITEO) (AS-CRITEO)
4	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
2 2	2606:ae80:145... 2606:ae80:1451:18::1720	25751 (VALUECLICK) (VALUECLICK)
1 26	142.250.64.66 142.250.64.66	15169 (GOOGLE) (GOOGLE)
1 1	2600:9000:251... 2600:9000:2511:da00:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	20.85.134.6 20.85.134.6	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	20.114.74.38 20.114.74.38	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
2 2	35.190.90.30 35.190.90.30	15169 (GOOGLE) (GOOGLE)
2 2	199.38.167.130 199.38.167.130	54312 (ROCKETFUEL) (ROCKETFUEL)
7	2620:100:a001::4 2620:100:a001::4	19750 (AS-CRITEO) (AS-CRITEO)
1	74.119.119.147 74.119.119.147	19750 (AS-CRITEO) (AS-CRITEO)
2	2620:100:a001::9 2620:100:a001::9	19750 (AS-CRITEO) (AS-CRITEO)
3	2620:100:a001... 2620:100:a001::16	19750 (AS-CRITEO) (AS-CRITEO)
1	2620:100:a001::3 2620:100:a001::3	19750 (AS-CRITEO) (AS-CRITEO)
9	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
24	34.102.128.115 34.102.128.115	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	2607:f8b0:400... 2607:f8b0:4006:820::2003	15169 (GOOGLE) (GOOGLE)
2	2620:116:800b... 2620:116:800b:21:4cb8:1820:80ca:50f7	14618 (AMAZON-AES) (AMAZON-AES)
1 1	216.200.232.249 216.200.232.249	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1	44.206.49.18 44.206.49.18	14618 (AMAZON-AES) (AMAZON-AES)
6 6	64.202.112.159 64.202.112.159	23352 (SERVERCEN...) (SERVERCENTRAL)
1 2	23.197.21.93 23.197.21.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	38.98.69.175 38.98.69.175	174 (COGENT-174) (COGENT-174)
2 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 2	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2 2	104.65.247.96 104.65.247.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	54.224.64.87 54.224.64.87	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1f18:4e9... 2600:1f18:4e9:5a01:8254:be27:a710:e85f	14618 (AMAZON-AES) (AMAZON-AES)
1 1	51.222.239.230 51.222.239.230	16276 (OVH) (OVH)
180	37

11 45.147.197.153 (Dronten, Netherlands)

ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: vm1670795.nvme.had.yt

pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:6b8:20::215 (Moscow, Russian Federation) 2 redirects

ASN208722 (GLOBAL_DC, FI)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 77.88.55.60 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: yandex.ru

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8:a::a (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3038::6815:e9df (United States)

ASN13335 (CLOUDFLARENET, US)

xp4stm90bvzr.frontroute.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:4006:81c::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::16b (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

matchid.adfox.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.46.183.20 (United States)

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1148:db00::17 (Russian Federation)

ASN47764 (VK-AS, RU)

ad.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.180.193.90 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: bs.yandex.ru

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.202.52 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host152.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.184.81.35 (Kyiv, Ukraine)

ASN28907 (MIROHOST Web hosting, datacenter and domain names registration in Ukraine, US)
PTR: c.hit.ua

c.hit.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::1:119 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80e::200e (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:80e::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:817::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)

2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:821::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a001::24 (United States)

ASN19750 (AS-CRITEO, US)

ads.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81c::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1451:18::1720 (United States) 2 redirects

ASN25751 (VALUECLICK, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 142.250.64.66 (Staten Island, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2511:da00:19:fc2c:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.85.134.6 (Tappahannock, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

mweb.ck.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.114.74.38 (San Antonio, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

beacon.walmart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.90.30 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.38.167.130 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.147 (United States)

ASN19750 (AS-CRITEO, US)

cat.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:a001::9 (United States)

ASN19750 (AS-CRITEO, US)

imageproxy.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a001::16 (United States)

ASN19750 (AS-CRITEO, US)

csm.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a001::3 (United States)

ASN19750 (AS-CRITEO, US)

rtb.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:81c::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 34.102.128.115 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 115.128.102.34.bc.googleusercontent.com

g.bidbrain.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:820::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800b:21:4cb8:1820:80ca:50f7 (United States)

ASN14618 (AMAZON-AES, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.232.249 (Frederick, United States) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.206.49.18 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-49-18.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 64.202.112.159 (Chicago, United States) 6 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.197.21.93 (Piscataway, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-21-93.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:18ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.98.69.175 (New York, United States) 1 redirects

ASN174 (COGENT-174, US)

aep.mxptint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.178.172 (North Charleston, United States) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.65.247.96 (Miami, United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-65-247-96.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.224.64.87 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-224-64-87.compute-1.amazonaws.com

sync.extend.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:4e9:5a01:8254:be27:a710:e85f (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.222.239.230 (Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: ip230.ip-51-222-239.net

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 216 googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 cm.g.doubleclick.net — Cisco Umbrella Rank: 254	241 KB
24	bidbrain.app g.bidbrain.app — Cisco Umbrella Rank: 35783	3 KB
20	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 135 2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 160	262 KB
12	criteo.net static.criteo.net — Cisco Umbrella Rank: 568 imageproxy.us.criteo.net — Cisco Umbrella Rank: 3134 csm.us.criteo.net — Cisco Umbrella Rank: 3113	237 KB
12	frontroute.org xp4stm90bvzr.frontroute.org — Cisco Umbrella Rank: 868126
12	yastatic.net 2 redirects yastatic.net — Cisco Umbrella Rank: 5573	212 KB
11	bookmp3.ru pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	297 KB
9	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 88	6 KB
7	google.com adservice.google.com — Cisco Umbrella Rank: 113 www.google.com — Cisco Umbrella Rank: 10	743 B
7	yandex.ru yandex.ru — Cisco Umbrella Rank: 1687 matchid.adfox.yandex.ru — Cisco Umbrella Rank: 25803 an.yandex.ru — Cisco Umbrella Rank: 4935 mc.yandex.ru — Cisco Umbrella Rank: 3245	122 KB
6	zemanta.com 6 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 573	4 KB
5	gstatic.com fonts.gstatic.com	78 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 205	225 KB
4	criteo.com ads.us.criteo.com — Cisco Umbrella Rank: 2980 dis.criteo.com — Cisco Umbrella Rank: 608 cat.va.us.criteo.com — Cisco Umbrella Rank: 2912 rtb.va.us.criteo.com — Cisco Umbrella Rank: 7430	44 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 63	21 KB
2	owneriq.net 2 redirects px.owneriq.net — Cisco Umbrella Rank: 1921	2 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 359	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 383	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 893 s.tribalfusion.com — Cisco Umbrella Rank: 1946	1 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1425	606 B
2	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 862	926 B
2	rfihub.com 2 redirects a.rfihub.com — Cisco Umbrella Rank: 3394	2 KB
2	mookie1.com 2 redirects odr.mookie1.com — Cisco Umbrella Rank: 1251	1 KB
2	dotomi.com 2 redirects dclk-match.dotomi.com — Cisco Umbrella Rank: 3235	892 B
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9378	2 KB
1	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 857	514 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 481	714 B
1	extend.tv 1 redirects sync.extend.tv — Cisco Umbrella Rank: 3341	610 B
1	ctnsnet.com 1 redirects ius.ctnsnet.com — Cisco Umbrella Rank: 8246	623 B
1	mxptint.net 1 redirects aep.mxptint.net — Cisco Umbrella Rank: 7236	731 B
1	adentifi.com rtb.adentifi.com — Cisco Umbrella Rank: 1366	35 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 8041	554 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 577	877 B
1	walmart.com 1 redirects beacon.walmart.com — Cisco Umbrella Rank: 5809	582 B
1	inmobi.com 1 redirects mweb.ck.inmobi.com — Cisco Umbrella Rank: 4755	466 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 696	684 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1129	551 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 79	76 KB
1	hit.ua c.hit.ua — Cisco Umbrella Rank: 144453	739 B
1	mail.ru ad.mail.ru — Cisco Umbrella Rank: 9416	384 B
1	betweendigital.com ads.betweendigital.com — Cisco Umbrella Rank: 1863	943 B
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
180	42

	Domain	Requested by
26	cm.g.doubleclick.net	1 redirects googleads.g.doubleclick.net pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
24	g.bidbrain.app	googleads.g.doubleclick.net pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
12	xp4stm90bvzr.frontroute.org	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
12	yastatic.net	2 redirects yastatic.net
11	pagead2.googlesyndication.com	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
11	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
9	fonts.googleapis.com	googleads.g.doubleclick.net
8	tpc.googlesyndication.com	googleads.g.doubleclick.net
7	static.criteo.net	ads.us.criteo.com
6	b1sync.zemanta.com	6 redirects
5	fonts.gstatic.com	fonts.googleapis.com
5	securepubads.g.doubleclick.net	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru securepubads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net
4	www.google.com	googleads.g.doubleclick.net
3	csm.us.criteo.net	ads.us.criteo.com
3	adservice.google.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
3	www.google-analytics.com	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru www.google-analytics.com www.googletagmanager.com
3	an.yandex.ru	yastatic.net
2	px.owneriq.net	2 redirects
2	x.bidswitch.net	2 redirects
2	match.adsrvr.org	2 redirects
2	sync.teads.tv	1 redirects pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
2	cms.quantserve.com	googleads.g.doubleclick.net
2	imageproxy.us.criteo.net	ads.us.criteo.com
2	a.rfihub.com	2 redirects
2	odr.mookie1.com	2 redirects
2	dclk-match.dotomi.com	2 redirects
2	counter.yadro.ru	1 redirects pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
2	yandex.ru	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	onetag-sys.com	1 redirects
1	pr-bh.ybp.yahoo.com	1 redirects
1	sync.extend.tv	1 redirects
1	ius.ctnsnet.com	1 redirects
1	aep.mxptint.net	1 redirects
1	s.tribalfusion.com	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	a.tribalfusion.com	1 redirects
1	rtb.adentifi.com	googleads.g.doubleclick.net
1	ads.travelaudience.com	1 redirects
1	sync.mathtag.com	1 redirects
1	rtb.va.us.criteo.com	googleads.g.doubleclick.net
1	cat.va.us.criteo.com	ads.us.criteo.com
1	dis.criteo.com	googleads.g.doubleclick.net
1	beacon.walmart.com	1 redirects
1	mweb.ck.inmobi.com	1 redirects
1	d.agkn.com	1 redirects
1	ads.us.criteo.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.googletagmanager.com	www.google-analytics.com
1	2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	mc.yandex.ru	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	c.hit.ua	pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	ad.mail.ru	yastatic.net
1	ads.betweendigital.com	yastatic.net
1	matchid.adfox.yandex.ru	yastatic.net
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
180	56

This site contains links to these domains. Also see Links.

Domain
mir-knigi.info
vk.com
www.facebook.com
twitter.com
bookmp3.ru
www.liveinternet.ru
hit.ua

Subject Issuer	Validity	Valid
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru R3	`2023-06-08` - `2023-09-06`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
frontroute.org E1	`2023-06-25` - `2023-09-23`	3 months	crt.sh
matchid.adfox.yandex.ru GlobalSign RSA OV SSL CA 2018	`2023-06-01` - `2023-11-24`	6 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2023-02-01` - `2023-08-01`	6 months	crt.sh
*.ads.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-13` - `2024-02-13`	a year	crt.sh
*.mail.ru GlobalSign ECC OV SSL CA 2018	`2022-10-18` - `2023-11-19`	a year	crt.sh
bs.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-04-08` - `2023-10-07`	6 months	crt.sh
hit.ua R3	`2023-06-13` - `2023-09-11`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-03-17` - `2023-08-27`	5 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-27` - `2023-09-23`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-12` - `2023-08-10`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-27` - `2023-08-27`	3 months	crt.sh
*.va.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-01` - `2023-08-02`	3 months	crt.sh
*.us.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-04` - `2023-08-31`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
g.bidbrain.app GTS CA 1D4	`2023-05-28` - `2023-08-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-06-19` - `2023-09-11`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
adentifi.com Amazon RSA 2048 M01	`2023-07-06` - `2024-08-03`	a year	crt.sh

This page contains 13 frames:

Primary Page: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Frame ID: CD475817C0C868BF95A3AAF240B440E3
Requests: 61 HTTP requests in this frame

Frame: https://2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 32895B5E56A4169C1F4EA625E71AEC80
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20190131/zrt_lookup.html
Frame ID: 1165AFCC562292848F68D4346A94EFBF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176
Frame ID: AB76ADDA10AE0B05CD771235BA7FFF95
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&adk=1812271804&adf=3025194257&lmt=1688826895&plat=2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ea=0&pra=7&wgl=1&easpi=1&asntpc=1000&asro=0&easppi=1&aslmt=0.4&asamt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895561&bpp=2&bdt=5673&idt=153&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&prev_fmts=710x178&nras=1&correlator=1753909160374&frm=20&pv=1&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=166
Frame ID: 0C1BF2EADBCE8C8FD3CE293701BC3EDF
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZKl0DwALebkE0aHBAAzdu2-ETap1CRwQWStTwg&u=%7CPEJmSnDN9WO8SHHdp7rMZXutkU%2B5BsN8Hi%2BjYnjr54w%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92IuRSFNw2pJuXDhXMlF90dLRZUzCRxD8k1bbz4FCjqio5rpmo1xONCOSE0EVUqQbmEf__gHRiFwaY_lD7sap4KQhjkKFgAAkkRnSoXfjfMkW4A_zDmMZrG0NLwUa2gADbX_iOSexosnPAOP8NUiL0R6pysuFVZyMI7meLgGZzcQMIK61i-bptMhvQJbCGj-GTEGnQOwIN91NrCRlYiGbZw9lhFrYaU1XJ5979slhLLpC4LpkZ-YVa10tP1XbqzyCHMLKVPODdDE5PVoqArZDy65bSQUh1Tn6-mLxAwuvM6dtBjXBJq3hN7DusW7UcAxAkYc9kQ9MQ4G1bdl_0Mx5cV8QNzwLAjJcXSvFUzm3jp2pK4aHWbJdLT4fdBmKn2NxdnWiND7yYmiR66OXqx-RdBCJ8ZBpjdM67sSAUBgJVLxG85JPUQ5rQ3Cv15ZeFAwxp2R9YHSnPX51i4HDJq-a3476MoJ7a03vJrEYHfI837jIvVzCGcbtaYbaTODO27PH2Cpte-u8WCQRusNbmKL7La9VPquV3d580Tw79BgBCZC8hVF-Y0C7Lzk&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxdE5D3SpZLnzLcHDxtYPu7uzuAacge-wXJKat4ynAcCNtwEQASAAYMnujovApIwQggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBKMCT9Cy4Hmrqe91USTPYkdtAyYq-FbpQOH_EJl-qvDBueQgMH7XqxTPBLyburldTIE4o6mCrK79zeCY33xBYPCqogXIUrRzh2Wof-dAJ26sibBgpbiOwLEome-k9UWpFUTB5rQeushq3B2N90p4AJqTAssELqb3tS6ImMPNsV7QyUlReWp9vOGw0TSDeBqdAdk3IsoJTkn7jA7v_pKdHM7MYyt7d9p3A4dzwOanB-7t485Fz-97MKp4NqxneAal9nWXHGh8d2UqPN5MpTus4HerMMecoMgOsPTvk18YDL9KPThM6HP0mOOGhgXswUWqs-h93uXEzWciHvHNGQkBrb6a1EJjAqYXtp23fSEXQJCXSXLlH23Cn5f-xvnbPq1OvvtDi4ofgAaT5fKutKKC5iqgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2twZ858gAViSkZCUzuXrpP5OekFQ%26client%3Dca-pub-1618592205083780%26adurl%3D
Frame ID: EB751B5F1254B0F5A6C5D9B0DA34B0C1
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E7270A324EAB321848F0EA066FBC7C36
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Frame ID: D9BE9814B1C1386AA724DA23A705DD76
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Frame ID: A35EBBDEDAAF4C88DD5E7D98FC9FDD16
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Frame ID: 0D47AFF5DDD50A0A1E99495C048E0BBB
Requests: 20 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 233812F752382C036EF26AED9B974301
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 90F5DD0D34E3F6BBFA93A2D4F7D65305
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7F0F3A2F29E4F73F5C9945CF5E279565
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Аудиокниги слушать онлайн бесплатно :: bookmp3.ru

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

180
Requests

85 %
HTTPS

51 %
IPv6

42
Domains

56
Subdomains

37
IPs

5
Countries

1830 kB
Transfer

5501 kB
Size

55
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://mir-knigi.info/
Title: Книги

Search URL Search Domain Scan URL

URL: https://vk.com/bookmp3_ru

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bookmp3ru/

Search URL Search Domain Scan URL

URL: https://twitter.com/bookmp3

Search URL Search Domain Scan URL

URL: https://bookmp3.ru/rss

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/authors
Title: «Авторы»,

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/genres
Title: «Жанры»

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/top
Title: «Топ 100»

Search URL Search Domain Scan URL

URL: https://www.liveinternet.ru/click

Search URL Search Domain Scan URL

URL: http://hit.ua/?x=84925
Title:     <img src='//c.hit.ua/hit?i=84925&g=0&x=1' border='0' width='88' height='31' alt='hit.ua: сейчас на сайте, посетителей и просмотров за сегодня' title='hit.ua: сейчас на сайте, посетителей и просмотров за сегодня'/>

Search URL Search Domain Scan URL

URL: https://bookmp3.ru/
Title: bookmp3.ru

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://yastatic.net/pcode/adfox/header-bidding.js HTTP 302
https://yandex.ru/ads/system/header-bidding.js

Request Chain 5

https://yastatic.net/pcode/adfox/loader.js HTTP 302
https://yandex.ru/ads/system/context.js

Request Chain 44

https://counter.yadro.ru/hit?t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362 HTTP 302
https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362

Request Chain 68

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_cver=1&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbOFCFpMUWMdHHuHp2okZ12aUjIAlN1M1VvI5CxtILwRqduBtjR3 HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=54b7a75cae7f21c6&is_secure=true&networkId=14000&version=1&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_cver=1&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbOFCFpMUWMdHHuHp2okZ12aUjIAlN1M1VvI5CxtILwRqduBtjR3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHSH1MP99UfAN4Ri4VAAAAAAA&expiration=1688913296&google_cver=1&is_secure=true&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbOFCFpMUWMdHHuHp2okZ12aUjIAlN1M1VvI5CxtILwRqduBtjR3

Request Chain 69

https://d.agkn.com/pixel/2175/?google_gid=CAESEPfAhBxGshZ5XrCCfb08Ap4&google_cver=1&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ&google_hm=Q0FFU0VQZkFoQnhHc2haNVhyQ0NmYjA4QXA0

Request Chain 70

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=1&google_push=AaAOQGFVKlz6GGdLvtw-oPG5087XSkr5mZWCZ3L1BFEpvqmcFY8qTuxf6BZGxxnbXe5gb3RdFtbuqlNE9GjeXX7ez1WqTWeXYjDKJDUV HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=OThlMGNiZjMtODEwNy00YTc5LTkxNmEtMzgyNDFlNGIzYWQ3&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=1&google_push=AaAOQGFVKlz6GGdLvtw-oPG5087XSkr5mZWCZ3L1BFEpvqmcFY8qTuxf6BZGxxnbXe5gb3RdFtbuqlNE9GjeXX7ez1WqTWeXYjDKJDUV

Request Chain 71

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcELrnYQAO3BhvJq2qQXcF3t64px542uY89w_X4GKVnHQuzzfCeTSIOBoeGLSq7A7gxKubo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Qg20Gp5F8-NqwhJMKB0ta4&tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcELrnYQAO3BhvJq2qQXcF3t64px542uY89w_X4GKVnHQuzzfCeTSIOBoeGLSq7A7gxKubo

Request Chain 73

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJobGn8iQgs3zh6mE9QdVB0&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-m_xxu6OJi&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-m_xxu6OJi&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI

Request Chain 74

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESECdSqHSFviyN-5R0sKEIuI0&google_cver=1&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRKZEjPFRAKy HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRKZEjPFRAKy&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==

Request Chain 126

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEAgNxWxrKLX95L7KeEOEWog&google_cver=1&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEkmHfcnBItylqi4w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEkmHfcnBItylqi4w

Request Chain 127

https://ads.travelaudience.com/google_pixel?google_gid=CAESENAB6ggZ5Xx2wbJHf_VmfEY&google_cver=1&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_Imh6bnrug3P3460 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=ijWgU0IERGmrMnwXq40nVg2&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_Imh6bnrug3P3460

Request Chain 129

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo&google_hm=X0JYMlZ0eUV5cmw2SXZqbzVuQ3M=

Request Chain 131

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESECbOQfbIhMw9mDRKkgZfffA&google_cver=1&google_push=AaAOQGE9LYISRFFQUUHvOZuKUAcCKX2NfPUc3bfovmt3VZWdpjaozpAadEY460sbbO_O-MgkGhcGORDm0samuNTtKpQeMTClLRxQc7pO HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=YjNiNDJlN2UtMDZkNS00NDJmLTg2YzQtMTlkOGM2MzEwZDgx&google_push=AaAOQGE9LYISRFFQUUHvOZuKUAcCKX2NfPUc3bfovmt3VZWdpjaozpAadEY460sbbO_O-MgkGhcGORDm0samuNTtKpQeMTClLRxQc7pO HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 134

https://a.tribalfusion.com/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 135

https://aep.mxptint.net/sn.ashx?google_gid=CAESENfsGcSNYz8QB0AUfw8rWOc&google_cver=1&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw&google_hm=UjMzNjQ3XzEwNTdFQ0UwMF80MkFCOUM4Ng%3D%3D

Request Chain 136

https://match.adsrvr.org/track/cmf/google?google_gid=CAESENrrtOULOg_-etik_5enmQg&google_cver=1&google_push=AaAOQGGbu8-l1AerohuevIX4XiOcIcnpdlzTNP8cgoIu25nKtk_T3LfSXXIMwrdDQebDA_6yL7j67Dx4B_7zJ-rg30YV0kinOYj6xA HTTP 302
https://match.adsrvr.org/track/cmb/google?google_gid=CAESENrrtOULOg_-etik_5enmQg&google_cver=1&google_push=AaAOQGGbu8-l1AerohuevIX4XiOcIcnpdlzTNP8cgoIu25nKtk_T3LfSXXIMwrdDQebDA_6yL7j67Dx4B_7zJ-rg30YV0kinOYj6xA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MjIyODc2ODQtZGExMy00MTRiLWJjZDQtNmJjZGFiYjFmYmNj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=22287684-da13-414b-bcd4-6bcdabb1fbcc

Request Chain 137

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEBDNGd5e79k6ndxtTVDhMSk&google_cver=1&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEBDNGd5e79k6ndxtTVDhMSk&google_cver=1&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA&google_hm=R57VnGcQTCmXjwRKJqpXKg==

Request Chain 138

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba&google_hm=cENnV0JIaWJ1MFh6WlQtRFVmdDE=

Request Chain 139

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEOlRjI7Tnep0RVE3LTqd9bE&google_cver=1&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySuI2Ep6aQw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySuI2Ep6aQw&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==

Request Chain 140

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEPSputcLtwlMl181mtn_eR0&google_cver=1&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2azOjB1YnCnpx89Btuv_BHFCO9V0jC6xWdeZwnA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2azOjB1YnCnpx89Btuv_BHFCO9V0jC6xWdeZwnA&google_hm=1GtC-1lgSoqy3HeDNEFOfCM

Request Chain 152

https://px.owneriq.net/ecmg?google_gid=CAESEMyp5ejsD5FKlJ3yfkVdmX8&google_cver=1&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA%26google_cver%3d1%26google_gid%3dCAESEMyp5ejsD5FKlJ3yfkVdmX8%26google_hm%3dUTc0MjExMzI5NjEyOTUwMTg0MDI%3d&uid=Q7421132961295018402&ref=%2Fecmg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA&google_cver=1&google_gid=CAESEMyp5ejsD5FKlJ3yfkVdmX8&google_hm=UTc0MjExMzI5NjEyOTUwMTg0MDI=

Request Chain 153

https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESEF9A5fBh7T0PbSilHNYR7mo&google_cver=1&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w2xv0zbcy6r48GTJJTg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w2xv0zbcy6r48GTJJTg

Request Chain 154

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG7n8W7fxE0VXJ2icQUlLZI&google_cver=1&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B452QYHA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B452QYHA&google_hm=eS1pdmxwMXZaRTJwSDU3ZF95c2loQ0tRWXNINVByeTlaSH5B

Request Chain 155

https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEJjExgtmhJ9PsrKrtSlo8a0&google_cver=1&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn5Jifiw2gECTqjlP5vZ1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn5Jifiw2gECTqjlP5vZ1&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI

Request Chain 156

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA&google_hm=OVB6ckl5RW11NnQ0S2Mxb3lxYlM=

Request Chain 157

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAbi1E9bwe4SJekFqQ1HjEw&google_cver=1&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V-Bn-B6M_iZcaq_rmxZ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiTXtYcDyGuZEAFexmGmkeiIzAtt6uBXg_g&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V-Bn-B6M_iZcaq_rmxZ

180 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/ 70 KB
14 KB 1196ms
1098ms Document
text/html 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard / PHP/7.1.33

Resource Hash

536e34c7565c4714671ae6719af2c802921c8b21ccb05d87e4ffe3fa7ce9de17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: max-age=1, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 08 Jul 2023 14:34:49 GMT
expires: Sat, 08 Jul 2023 14:34:50 GMT
server: ddos-guard
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-powered-by: PHP/7.1.33

GET
H2 200 jquery.js Show response
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 334 KB
94 KB 455ms
454ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/jquery.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

b9db30db84c353b393ebed43c0803e40d62453ec010584b9449a28f0348cd01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 08:53:06 GMT
server: ddos-guard
age: 1
etag: W/"536b8-55b2d6f820080-gzip"
vary: Accept-Encoding
content-type: application/javascript
ddg-cache-status: MISS
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Sat, 08 Jul 2023 14:34:51 GMT

GET
H2 200 main.js Show response
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 860 B
585 B 393ms
392ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/main.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

a94755ecd90a113ceb5ffbb9a9834639bbf215711895074c4181eb309929ca25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Wed, 25 Oct 2017 18:13:28 GMT
server: ddos-guard
age: 1
etag: W/"35c-55c630327a200-gzip"
vary: Accept-Encoding
content-type: application/javascript
ddg-cache-status: MISS
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Sat, 08 Jul 2023 14:34:51 GMT

GET
H2 200 style.css
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/ 94 KB
15 KB 464ms
463ms Stylesheet
text/css 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

47a37cabd33f930dd28119e3ba60cca269770f1b2a774a52bad0a75d8076cd8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Wed, 30 Jun 2021 13:22:17 GMT
server: ddos-guard
age: 1
etag: W/"17698-5c5fb9c888be4-gzip"
vary: Accept-Encoding
content-type: text/css
ddg-cache-status: MISS
cache-control: max-age=2592000, public
accept-ranges: bytes
expires: Mon, 07 Aug 2023 14:34:50 GMT

GET
H2 200 font-awesome.min.css
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/ 30 KB
7 KB 414ms
413ms Stylesheet
text/css 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 15:14:28 GMT
server: ddos-guard
age: 1
etag: W/"7918-55b32c3619d00-gzip"
vary: Accept-Encoding
content-type: text/css
ddg-cache-status: MISS
cache-control: max-age=2592000, public
accept-ranges: bytes
expires: Mon, 07 Aug 2023 14:34:50 GMT

GET
H2

200

header-bidding.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/header-bidding.js
https://yandex.ru/ads/system/header-bidding.js

115 KB
34 KB

743ms
157ms

Script
text/javascript

77.88.55.60
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/header-bidding.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

77.88.55.60 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

yandex.ru

Software

Resource Hash

32ec44401c24a4a2e559d925d0f1296451a9e28ddeaa297fee2157e8e04c1af4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1688826892247764-17843693618697093364-balancer-l7leveler-kubr-yp-sas-15-BAL-1535
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 08 Jul 2023 15:34:52 GMT

Redirect headers

date: Sat, 08 Jul 2023 14:34:51 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
location: https://yandex.ru/ads/system/header-bidding.js
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0

GET
H2

200

context.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/loader.js
https://yandex.ru/ads/system/context.js

304 KB
87 KB

1831ms
917ms

Script
text/javascript

2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

29a7c723356d24b87edf9b33b45d0783eb2c8a4c4639c054adbc2c8f759e48f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1688826891250336-10922498476357360355-balancer-l7leveler-kubr-yp-vla-58-BAL-450
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 08 Jul 2023 15:34:51 GMT

Redirect headers

date: Sat, 08 Jul 2023 14:34:50 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
location: https://yandex.ru/ads/system/context.js
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 76 KB
26 KB 870ms
804ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1eab251474ea81fd84ae5c0d4996f5f7774e0d717ee27184cdc456c18124025

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25844
x-xss-protection: 0
server: cafe
etag: 448 / 19546 / 31075866 / config-hash: 12381638052069933206
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:53 GMT

GET
H2 502 audiobook-vstan-i-umri.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/2/0/ 0
0 448ms
354ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/2/0/audiobook-vstan-i-umri.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-mlada.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/9/ 0
0 146ms
145ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/9/audiobook-mlada.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-golova-professora-douehlja-7.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/8/ 0
0 143ms
142ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/8/audiobook-golova-professora-douehlja-7.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-berezovyjj-sok.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/7/ 0
0 149ms
149ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/7/audiobook-berezovyjj-sok.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-o-ljubvi-6.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/6/ 0
0 141ms
140ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/6/audiobook-o-ljubvi-6.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-probuzhdenie-professora-berna.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/5/ 0
0 145ms
144ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/5/audiobook-probuzhdenie-professora-berna.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-aleksandra.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/4/ 0
0 142ms
141ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/4/audiobook-aleksandra.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-udivitelnye-prikljuchenija-egora-na-planete-dinozavrov.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/3/ 0
0 142ms
142ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/3/audiobook-udivitelnye-prikljuchenija-egora-na-planete-dinozavrov.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-krasavicy-3.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/2/ 0
0 140ms
140ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/2/audiobook-krasavicy-3.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-ostrov-mira-1.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/1/ 0
0 141ms
141ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/1/audiobook-ostrov-mira-1.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-blazhenny-krotkie-ibo-oni-nasledujut-zemlju.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/0/ 0
0 142ms
142ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/0/audiobook-blazhenny-krotkie-ibo-oni-nasledujut-zemlju.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 502 audiobook-dikijj-angel.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/0/9/ 0
0 140ms
140ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/0/9/audiobook-dikijj-angel.jpg
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 139 KB
48 KB 121ms
58ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

507ec1ad6a9f25b2a4a1a2c314345a3a3d06abaa06c268ca3ea4f18c7560939e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48709
x-xss-protection: 0
server: cafe
etag: 5378083488889260289
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:55 GMT

GET
H2 200 webfont.js Show response
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 13 KB
5 KB 149ms
149ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/webfont.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 08:53:02 GMT
server: ddos-guard
age: 0
etag: W/"3384-55b2d6f44f780-gzip"
vary: Accept-Encoding
content-type: application/javascript
ddg-cache-status: MISS
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Sat, 08 Jul 2023 14:34:51 GMT

GET
H2 200 audioplayer.js Show response
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 386 KB
58 KB 476ms
476ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/audioplayer.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

f919c02713441d1502a5297ec6201783ecf8070a47d5df866a78ca2fb83bc865

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 14:24:22 GMT
server: ddos-guard
age: 2
etag: W/"607be-55b321035b180-gzip"
vary: Accept-Encoding
content-type: application/javascript
ddg-cache-status: MISS
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Sat, 08 Jul 2023 14:34:51 GMT

GET
H2 200 getcookie Show response
matchid.adfox.yandex.ru/ 87 B
308 B 1422ms
157ms XHR
application/json 2a02:6b8::16b
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://matchid.adfox.yandex.ru/getcookie

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a02:6b8::16b Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

ad25b0cf60d28e786d5b23c84960d3c3eace53fbdb60e7f88bf55b93e970ee9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
date: Sat, 08 Jul 2023 14:34:53 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
timing-allow-origin: *
content-length: 87
content-type: application/json

GET
H2 200 3071ce134dc3cec5ecfc.js Show response
yastatic.net/partner-code-bundles/801529/ 9 KB
4 KB 216ms
213ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/3071ce134dc3cec5ecfc.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

3d678f40df758f6400bd08adba790bd7084bfb71e276e9486665c5c1dd1fe204

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 3560
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "c806d2a39a6a8884ae875d17cf84085e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:38 GMT

GET
H2 200 0272200b03866b2261dc.js Show response
yastatic.net/partner-code-bundles/801529/ 30 KB
9 KB 240ms
238ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/0272200b03866b2261dc.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

98d34a13bb45044273edb9133e3584a4396cf5f00017c95ccf3aa06187f49582

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8560
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "4d895caff79f652914b6021b127fab4b"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:52 GMT

POST
H2 200 adjson Show response
ads.betweendigital.com/ 11 B
943 B 337ms
259ms XHR
application/json 96.46.183.20
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=adfox
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.46.183.20 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

POST
H/1.1 200
OK / Show response
ad.mail.ru/hbid_yandex/ 11 B
384 B 478ms
183ms XHR
application/json 2a00:1148:db00::17
VK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.mail.ru/hbid_yandex/
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a00:1148:db00::17 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sat, 08 Jul 2023 14:34:52 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
Cache-Control: private, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *

GET
H2 200 3814d08fd371bb6652a0.js Show response
yastatic.net/partner-code-bundles/801529/ 14 KB
5 KB 254ms
252ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/3814d08fd371bb6652a0.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e0c8101118f37916c887f89ad75c682464d9b6c7e685d04de2b730628c38e9fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 4779
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "d282a81398d06799c46c31a20bb0b306"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 cfd50b910e0222172e67.js Show response
yastatic.net/partner-code-bundles/801529/ 19 KB
7 KB 273ms
271ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/cfd50b910e0222172e67.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

7320a8ba176680fddc0ae5c2df009477bd3f38b889a226f90b806eed4e20e72e

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 6462
last-modified: Thu, 06 Jul 2023 19:04:22 GMT
server: nginx/1.17.9
etag: "a5048fac3871ca96bf59724606e77053"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 486953a4c8bcd95c4b74.js Show response
yastatic.net/partner-code-bundles/801529/ 112 KB
24 KB 306ms
305ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/486953a4c8bcd95c4b74.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e7c67bbf39cb31a203980714670e128242d6713e39e36e99a3f7cd26bd50b96e

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 23497
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "db5d38afdc382a73841a710c6bf4d310"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 332ms
330ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:06:55 GMT

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 140ms
140ms Font
font/woff2 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
server: nginx/1.17.9
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: 3f37a29d5443e74a
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 20:20:07 GMT

GET
H2 200 b4f9d955f303d34a52a9.js Show response
yastatic.net/partner-code-bundles/801529/ 24 KB
8 KB 333ms
331ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/b4f9d955f303d34a52a9.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e4527eeacda0c51dfb7a0f339f7522a8f2169ed05dc94ac947b4a5616cd56f4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7952
last-modified: Thu, 06 Jul 2023 19:04:22 GMT
server: nginx/1.17.9
etag: "e1e96f2241f79d43a9983e70a0bbbc87"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 437e0d06e0c726689eaa.js Show response
yastatic.net/partner-code-bundles/801529/ 7 KB
3 KB 333ms
332ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/437e0d06e0c726689eaa.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

7718a27fe3203dbe115ffe7fb1253ccd4f84cb6ac2c9c56a5c84186c8e912ec8

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 2083
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "fff19868fe621618ffaeedaa57b9d91e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 221bda159387778e22db.js Show response
yastatic.net/partner-code-bundles/801529/ 626 KB
117 KB 334ms
333ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/801529/221bda159387778e22db.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

1718fde9aa3ddf3d77b0f2ae944f5d676d3223cfb88eda07b9b7db0485c472d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 118932
last-modified: Thu, 06 Jul 2023 19:04:21 GMT
server: nginx/1.17.9
etag: "35b88a3b2eaa81ba3bb6ba95556e0ad9"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 07 Jul 2053 21:08:28 GMT

GET
H2 200 fontawesome-webfont.woff2
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/fonts/ 75 KB
76 KB 204ms
203ms Font
application/octet-stream 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css
Origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 15:17:21 GMT
server: ddos-guard
age: 0
etag: "12d68-55b32cdb16240"
ddg-cache-status: MISS
cache-control: max-age=1
accept-ranges: bytes
content-length: 77160
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/ 392 KB
125 KB 25ms
24ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d076633408bf78e086b9125a46176d2fdeaf3a5d5b52bb9b3a9d562cea646006

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 15:36:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82700
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127592
x-xss-protection: 0
server: cafe
etag: 1084883806831873288
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 06 Jul 2024 15:36:35 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 83 B
101 B 90ms
40ms XHR
application/json 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98181e4ff67a4268ecf4a330a696d0290b3ec58f5eb8ad26085f0f0fa87a0835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76
x-xss-protection: 0
expires: Sat, 08 Jul 2023 14:34:55 GMT

GET
H2 200 bookmp3-logo.png
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 27 KB
27 KB 502ms
501ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/bookmp3-logo.png?v1

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

12d8aae0cf51d039bfbef1c8f7ec828851423f05c8f9e5d290b2c2e15cd9a8a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000;
last-modified: Sat, 21 Oct 2017 10:38:23 GMT
server: ddos-guard
age: 0
etag: "6d15-55c0c3048e5c0"
content-type: image/png
ddg-cache-status: MISS
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 27925
expires: Mon, 07 Aug 2023 14:34:55 GMT

GET
H2 200 icon-menu-dd.png
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 190 B
321 B 116ms
116ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/icon-menu-dd.png?v1

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

db0d17ee9c24794dc313d2588c0c19bccccb2f7439a0dcb6be8cc985df84baf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000;
last-modified: Thu, 12 Oct 2017 17:43:11 GMT
server: ddos-guard
age: 0
etag: "be-55b5d12ea89c0"
content-type: image/png
ddg-cache-status: MISS
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 190
expires: Mon, 07 Aug 2023 14:34:55 GMT

GET
H2 200 icon-search.png
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 380 B
459 B 132ms
132ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/icon-search.png?v1

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

3be3f024c46ff93eb55bb00f599911ef69c7957b19c8c3df9aca743259f35ae3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000;
last-modified: Thu, 12 Oct 2017 17:41:41 GMT
server: ddos-guard
age: 0
etag: "17c-55b5d0d8d3f40"
content-type: image/png
ddg-cache-status: MISS
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 380
expires: Mon, 07 Aug 2023 14:34:55 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 211 B
588 B 749ms
169ms XHR
application/json 213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=1642868250&pr1=3629224064&dl=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=&extid_tag_loader=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-07-08T14%3A34%3A55.374%2B00%3A00&pd=8&pw=6&pv=14&pdw=1600&pdh=1200&ylv=0.801529&ybv=0.801529&ytt=418364174630917&is-turbo=0&skip-token=&ad-session-id=218501688826895379&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1015%2C%22top%22%3A107%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A0%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=801529&p1=cmaok&p2=gxvo&slotNumber=2&bids=W3siYmlkZGVyTmFtZSI6ImJldHdlZW5kaWdpdGFsIiwiY2FtcGFpZ25faWQiOjgxMjk1NywicmVzcG9uc2VfdGltZSI6MzQyLCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiMzk0NTIxOCJ9LHsiYmlkZGVyTmFtZSI6Im15dGFyZ2V0IiwiY2FtcGFpZ25faWQiOjEwMzI3OTUsInJlc3BvbnNlX3RpbWUiOjQ4MywiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjgxNjAxNiJ9XQ%3D%3D&utf8=%E2%9C%93&pcode-test-ids=769344%2C0%2C69%3B801286%2C0%2C9%3B797746%2C0%2C31%3B780721%2C0%2C3%3B789403%2C0%2C91%3B794317%2C0%2C89%3B798346%2C0%2C56%3B795747%2C0%2C46%3B794562%2C0%2C32%3B788873%2C0%2C90%3B800949%2C0%2C25%3B681845%2C0%2C54&pcode-flags-map=eJy1WNty2zYQ%2FRc9JynvIP0GkiCFiiRYAJSsZDIYNVYddXzpOE6aOpN%2F7wKkZVFWITtx%2FSBTlPZosZezZ%2FltMsdCiSlbKJyrCqekUgXjijYqxU1D%2BOTk3bfJl9XF5%2FXkZCJ5RyavJrfrT7f0DN5Hke8HaPL9%2FasHmJazvMukUKxRLe4EsSIgNwn8HoE0OK2IIhmrH0AqKqR2Zk5zwvQFfJoyhXk9gl1%2F%2FWsPNfRDg5pTYWAz1jVScZJTTjINidvW7pnnBIG3PRscRNVdJSlnVQVojdQXhKsFltmU5ErSmihWFIJIO67vOWgvZpJKcBE3uUpZvtSZaDHHNZGAn5MCw%2B%2BOMAtciTFogILoAZQTyZc6AQ2RC8ZninDO7KlEYRSgZIswJENkGF4rOoPLjs%2FJEhAX4JKgZWOHixzko0dwP4NRsaZURYVLHbOuyhVksFoqMaNtH%2Fw5rroj1YYiFEdbRMhbNoOiX7JOKlExeKFvCeSga3LMKRFHwGI3cMfukdO2dxEKOCNCULgHH0p1Wld2sNh3A%2FR0MJUuIai5Ektoh5eHxnmuatrfzyomoL5TjrPZsZD80CkylhPV8erJ2DrbOmUtJ6YbH%2Fqyp4nh8xGc68DfCC%2FxE%2BQcwUu7ooAeJHUrl9AGNd0HfTbivMU0f3kPiw6ufxS10VT9wp7%2BB%2BZP5ecw5v8XgR%2FNvuF1aRhvTrigbMxzKIkTFO3axo7rDUy3hClAThXvVM5qTBvbmAsd5PnRQTMFc09ymlrNPdeJgsFcW%2FYmClcLvBRWS5jZSU99relemIeCNNJuE3qOM5rJwyzOBLcaJi6KezdNanpdorqGFhR4iTYwJQucETtG7A1DVw8fTgpOxBQIqqSZzS5yY38IERyxoLzWlMWBeXXFgU6CoklpboWAKHvu6NygJTguIV7DBNKlKzJOSKOEaO3%2BJG4w%2BIOhQlkz%2BIILrRVooVUDHAvnxO4UipOon%2FZa2BQw7JochmlvD%2BWzr47s9unMTE5hQjKWanaUJHDQFqUiIHwAwSrtoigOoj6cO2ErOVAVSIqZZHa%2F4yhw%2Fd34GWWkFlMA2cFrQAuYhJcd17Ov09IxI3RuDytynQD1upNz1Vea7HgzpCerKGRbTjnryukRWQxIfXwr%2FHZpMqpMq%2B2afZv8sb798LFe3ZxvriYnbui8mlxe%2F765WIsPq4vN1fnkxPs%2BQg2hDQyqqDGX6reOdMRM6LTCWgoBA%2Bz%2BwLvJ5Wpz8ebmM%2Fj2z%2BrqbP0Vrn%2FZXK7O159Gt85Xl%2BbO2d36qv%2F66svm9rq%2FvHyz8%2BbsajPc1chbBLhxs7q7uL77OHx8d9P%2F%2F3yzenO1%2FvvToy%2F8ubq%2B3BjT94eP2GAJ%2BVI14aV%2BzSlWEpdWXgNt7g3FZdqCQO45wZkECj9iGPpOvyyA%2Fr%2FX7KDi4aebrk6JleFQ6PrD6DAbk9lOwBKGUkqyviPnVFDgjiMwyOmrb1DIGXAMJ8N6YVYL3dpAYs%2FrU4SgTd1dYO2kkMuKlB2gvCRqyrjmMwaDE4T5syEjEIk9pGhBxdaa4ktDujQv8IECJ3nhYeRFr11SeK%2BDIMOv0zRPX%2BcZ9vw4JiQK83GFxWGYDHN%2BvJTu8IdkXTbtWUSrZ51JEARcs8ivMPKOsAiQVBCbXyg5Tj0dBBgyOeDi2kpvKEaBGx3yzayZsDZWqe7zFl7gjtR%2B0YbKA%2FvhI%2BQgCN0x8s55TeZoqbCA8hdmGFjREhca5kgMNWYmsVmLt88mhsXb3owH0HdwK1pOJbAwqZ%2FqI3D5%2FQILVWWWF%2FADKtQqeFACs8o7ADAQ05MgknCAgO2pZn18VcsElfuqcs8UJGU0qKbnPFgpGNOTqqCnR2o0SvxBiOBc5LP5HsNpRRs%2F0rjD7j0EoIAjDRrQHgRgimj3JJy0BEvDDXrG7h3hvrhHmB%2Bubi%2FG9Qza2d0F1Ujbvngm7TyA6aKd5hy2ZV1lDey7Yzf2vQAB5G9laSHUgsqpXkjMvLJHJfBdNJbTvf7pFTEUu3k%2BZceI%2FSGypoG5bjXaCKmFGCsUaIQZ0bUuWs3FWjAZmWfHDNH9IwA9smhFYXlaYCAZWsM4tMcjCcKor%2Fd%2BYJsHXb1usicgjtEg66a4Kfs%2BGxYFCftbhaW12WPHSYze%2Bv4valkwJw%3D%3D&use-server-side-rendering=1&pcode-icookie=hBfMxrlCJsvZwRFdz5M6oVic8U1DoyA4M%2FdUFHoHu%2BGgGo5zQaExrB4ZqPeu2GETg1R26dCXX3m1tjLeL5hCIdnnEaQ%3D&top-ancestor=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2936&grab=eyJncmFiX3ZlcnNpb24iOjIsIm9sZF9ncmFiX3NpemUiOjE2MH0KEqWksOS464EwUGcF5g9qy6LGMbwAvwB-Sjn5UE9CaUIbDZkz0urbOW9Ld1lGS_CW4NXmfD4oSiugzwxwhTFmpoP4TZ82VePWmYiZCTNmzCBjxsh04HXSgT4UIxmyIX5AGEMxO9mQdtIOZai7ruPPFxQP6VAP-RDPgTmULyA6-a578WSW5XRmGYXF5KM1ksMNDCAefFUnGMr5vLlWwPUPsF0_lA8leaaBuYW_VjXU84Wep_LBTlbymJedHPfiCdc3QL1QModod6I38H-ztGt_m-53DtSjtXJgdu0tUncoB_EU7zqYtx_0T6YdqE-7Trb8h-QG9NhSi9XtsdkLh9uT5qnV7oaPznpCbY_HYk-LaS4sdlhhh91AbcxNaZ6Zw5M6M6d2cworPDS_R9rxn2Hl9AcfIMeOP5T0qMY__LU5QRlNcd05HrXl8yUg_WDJkM8XlT1fMto5cLebGL_vuUteCG1HeFonyNHn1sUtOlL4_l8D9LtTcUT8MOpO9IMraMMhfmpQ2KFCz4wOgwBN1Ei1g57DQQUmZcubm4hv3lAjDmfmgOr2OHIYk9paGAywwk66Oup00kE3FqYwr1CamZyFkU8qLZxWO5-sMYPOJ09tt1pfmtway1tzQ_ry1tztKQQk6ay5mSLsBgjMAPxpLpqBYNATKn6e44Y8F7w_yOPuru8EiOWAvc3-S-61n-geVoFY0PbL81_9_0QMi5rfkAwMxHLCiglRyCVEbuXu2DTmlLZrnsFUmN0DfCf4l9yTk05Ee8P9kbWduPSElj9XE3ZX6FexAeJ4c5fLllkddmOYrUhuNtuNL2EvjFQ5NHY8LUVu5hG7q3GtaVIu139QYJOwgxllFnYL8XOM05DEzq1BXPSKGXRmqQCDwv4JeVvsZnIBztacA2dXntotN0wj0ZjvSVVyGEAL_9rIU_DUUXbx43R43MQeC3Ozj9xuzQBygBs4IAUm1qNF2ANnYHODt3-hyowWLooannipbfeFE0COKAyZcbE4UjjfYNvSaAsIBe8siyZOy1dEpFP8rz0B3iWmzJAa-M_RaMjP9xh6ADsacgIuF3UGY3Fs5Vmw4etqLWKL2wV5PFZPM0uYf6UzNU9-vm0lD9rF3ftOinj2tl9htiOsUGXwisymueJj8hEv0s9E9XHd4mF7EVK-SRxFWiAe2ZxUufHLCXVmJbeYI6J505AaczPlDwP--y5rWSDox6uKx7XSx69bYDmcD-l9eAuCbPNr8ed0-t-zmEt0SMCQR9wU9Jd-f-kNIo2cCwAxPgSyHwK_CO0nXczyKDB70suKkpamYH2bCRvy_xiRbMiiPQnM72sN-vQE53DSL7gcSn-JbORtXm_pDTAOxdJD4Wz-n7SQqQWgJBsfXfalPzmID0_aIV9EySxn4VzONHeXC1GGCh4rD-6943chuPKAUNL4ywBsxlNY-hTNVuOPF2oOKd9g9SolE91HiDyor4QB8o0W1UoT6UFAbQFSP9C6uPHaeX6f8vBDxF00vpLGx7gRS28ELvaMqpgjG_rPXqh1rwL1WJL4sGXEu06OlelkRbG_KlLm4veVAT_jVCw91Xk6koH5LKM9u8pl-yMbsBwz91ZuxMyR5-DWDEJxboqNRc-7sMVH_K1LIvxDvKdJNj2Rt0XnmdGtKf8Tm3OZREtvfKWPhvENln6Du8gyyXs-El1siR4JgQCWnIoqN0_gCip7tFpEU3rhMA7H0sMBthtUsTep4z_Csy420UYkssvgaz1dMyaEL8y1-GxUsLbbM6U1BwX6ZnfJpzVXF_UN6WCah2BXV_3TGtA1YP0lzp3-bdDCXwIuaDpbi_vBkG3SHSkW9JWXcTOyGFZic6y1J5Ht1xWdKDYVAhASmAHh6aL4zV0zzxzVtd8P0q6LVkG8fyzGt1gZIFY1_SeS2XIz5sh2IDyWxag5wudRYNfYokf4pXB2p7gmJrstqb0-a-WZiqSR0pKgv_TBLoPAMw7EQjflZfBojfBOo162IWGLLJT0pzqLeRrIZ6dXNNVZskWi0H8ySKcZi_rQkkutmcNcqN58_8O-s3AnLSpqxsLNTBHuEcfaoE8pzJtBd4JO2DURfI1-f-n3Mr7A0i9AXOLYmnphw1U8KZOkNsJ0SXmjYFXLsOTwVieKVkbUn5boqpIjwdwAXI1AND8Y-COVAZD2oHMzXzhg0KF8mE_Cac2oKZBV_DYVlLm5SDMjv5ZvlTpFuaY2XZWrK2ChgnSARx_azyPv45H38sjT8MjD4VZd5tNx5qa5oOJZaoeWTl4IuqpbajotdYLYQ6NoESCK3jT9XE22TnpKauqmoKWcn2mptqaqm3aVak34kpbxV-U1wv39OgFhzgFw040Sx-HW1TLpgqwGcQ7cWFHqAskhm2uRIdkSJYl10lYX_GE7SbvpFzni_eTPLK7HwVg8978TVDj62r_DVdWtzVHkq11UNYyev2hjGnmj3FWg08zWoahcXZfPbyanvzYnsSpq63uySoe6p8_2sBZhnv61TjYlLt36B_FrlDE75B1WckZX1W_8lGI9thtfENVUN7k-1s7ctJyVcWk9IZPbY_O74V_RxhP6xfdyzSkmLzJRPfaCqlPnIFqv_oWpe-2mXiw9McK79NGsQ5pVeT_ZUINwlalkjehlv_uil4uz9Xc9xaVA4kpqyrgLCsEb8yq3bA5f2wjptMgUn7avcm9TI1qHODHtfGREcFNM9aQ94SqpVrjwF2j3dQ-PfzRYklj190Ni2gvOJ33NPqWUpmP20x-jBxrqLznrzDf55MVCywVRc4AIYvBjVFG1SJaQmw_95rrcPGlqQjdsPKZsz7rmM0kbTNv2LlRMRbRmdDmiJmmGMPq5jZQ1x8lxfOh5toNF61s1EXMRC6d3_x_nP_uUMwD8&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

8bbb94eaf2cf5da2373af7967daf1641f574ce1951c9e0ef5847b134b206708d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Sat, 08 Jul 2023 14:34:56 GMT
x-yandex-req-id: 1688826896064052-67934576496458644400260-production-app-host-vla-pcode-447
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 211 B
256 B 862ms
289ms XHR
application/json 213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=1642868250&pr1=3353178094&dl=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=&extid_tag_loader=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-07-08T14%3A34%3A55.413%2B00%3A00&pd=8&pw=6&pv=14&pdw=1600&pdh=1200&ylv=0.801529&ybv=0.801529&ytt=418364174630917&is-turbo=0&skip-token=&ad-session-id=218501688826895379&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A1600%2C%22h%22%3A0%2C%22width%22%3A0%2C%22height%22%3A0%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A810%2C%22top%22%3A-12%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A1%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=801529&p1=cmaqk&p2=gxwa&slotNumber=3&bids=W10%3D&utf8=%E2%9C%93&pcode-test-ids=769344%2C0%2C69%3B801286%2C0%2C9%3B797746%2C0%2C31%3B780721%2C0%2C3%3B789403%2C0%2C91%3B794317%2C0%2C89%3B798346%2C0%2C56%3B795747%2C0%2C46%3B794562%2C0%2C32%3B788873%2C0%2C90%3B800949%2C0%2C25%3B681845%2C0%2C54&pcode-flags-map=eJy1WNty2zYQ%2FRc9JynvIP0GkiCFiiRYAJSsZDIYNVYddXzpOE6aOpN%2F7wKkZVFWITtx%2FSBTlPZosZezZ%2FltMsdCiSlbKJyrCqekUgXjijYqxU1D%2BOTk3bfJl9XF5%2FXkZCJ5RyavJrfrT7f0DN5Hke8HaPL9%2FasHmJazvMukUKxRLe4EsSIgNwn8HoE0OK2IIhmrH0AqKqR2Zk5zwvQFfJoyhXk9gl1%2F%2FWsPNfRDg5pTYWAz1jVScZJTTjINidvW7pnnBIG3PRscRNVdJSlnVQVojdQXhKsFltmU5ErSmihWFIJIO67vOWgvZpJKcBE3uUpZvtSZaDHHNZGAn5MCw%2B%2BOMAtciTFogILoAZQTyZc6AQ2RC8ZninDO7KlEYRSgZIswJENkGF4rOoPLjs%2FJEhAX4JKgZWOHixzko0dwP4NRsaZURYVLHbOuyhVksFoqMaNtH%2Fw5rroj1YYiFEdbRMhbNoOiX7JOKlExeKFvCeSga3LMKRFHwGI3cMfukdO2dxEKOCNCULgHH0p1Wld2sNh3A%2FR0MJUuIai5Ektoh5eHxnmuatrfzyomoL5TjrPZsZD80CkylhPV8erJ2DrbOmUtJ6YbH%2Fqyp4nh8xGc68DfCC%2FxE%2BQcwUu7ooAeJHUrl9AGNd0HfTbivMU0f3kPiw6ufxS10VT9wp7%2BB%2BZP5ecw5v8XgR%2FNvuF1aRhvTrigbMxzKIkTFO3axo7rDUy3hClAThXvVM5qTBvbmAsd5PnRQTMFc09ymlrNPdeJgsFcW%2FYmClcLvBRWS5jZSU99relemIeCNNJuE3qOM5rJwyzOBLcaJi6KezdNanpdorqGFhR4iTYwJQucETtG7A1DVw8fTgpOxBQIqqSZzS5yY38IERyxoLzWlMWBeXXFgU6CoklpboWAKHvu6NygJTguIV7DBNKlKzJOSKOEaO3%2BJG4w%2BIOhQlkz%2BIILrRVooVUDHAvnxO4UipOon%2FZa2BQw7JochmlvD%2BWzr47s9unMTE5hQjKWanaUJHDQFqUiIHwAwSrtoigOoj6cO2ErOVAVSIqZZHa%2F4yhw%2Fd34GWWkFlMA2cFrQAuYhJcd17Ov09IxI3RuDytynQD1upNz1Vea7HgzpCerKGRbTjnryukRWQxIfXwr%2FHZpMqpMq%2B2afZv8sb798LFe3ZxvriYnbui8mlxe%2F765WIsPq4vN1fnkxPs%2BQg2hDQyqqDGX6reOdMRM6LTCWgoBA%2Bz%2BwLvJ5Wpz8ebmM%2Fj2z%2BrqbP0Vrn%2FZXK7O159Gt85Xl%2BbO2d36qv%2F66svm9rq%2FvHyz8%2BbsajPc1chbBLhxs7q7uL77OHx8d9P%2F%2F3yzenO1%2FvvToy%2F8ubq%2B3BjT94eP2GAJ%2BVI14aV%2BzSlWEpdWXgNt7g3FZdqCQO45wZkECj9iGPpOvyyA%2Fr%2FX7KDi4aebrk6JleFQ6PrD6DAbk9lOwBKGUkqyviPnVFDgjiMwyOmrb1DIGXAMJ8N6YVYL3dpAYs%2FrU4SgTd1dYO2kkMuKlB2gvCRqyrjmMwaDE4T5syEjEIk9pGhBxdaa4ktDujQv8IECJ3nhYeRFr11SeK%2BDIMOv0zRPX%2BcZ9vw4JiQK83GFxWGYDHN%2BvJTu8IdkXTbtWUSrZ51JEARcs8ivMPKOsAiQVBCbXyg5Tj0dBBgyOeDi2kpvKEaBGx3yzayZsDZWqe7zFl7gjtR%2B0YbKA%2FvhI%2BQgCN0x8s55TeZoqbCA8hdmGFjREhca5kgMNWYmsVmLt88mhsXb3owH0HdwK1pOJbAwqZ%2FqI3D5%2FQILVWWWF%2FADKtQqeFACs8o7ADAQ05MgknCAgO2pZn18VcsElfuqcs8UJGU0qKbnPFgpGNOTqqCnR2o0SvxBiOBc5LP5HsNpRRs%2F0rjD7j0EoIAjDRrQHgRgimj3JJy0BEvDDXrG7h3hvrhHmB%2Bubi%2FG9Qza2d0F1Ujbvngm7TyA6aKd5hy2ZV1lDey7Yzf2vQAB5G9laSHUgsqpXkjMvLJHJfBdNJbTvf7pFTEUu3k%2BZceI%2FSGypoG5bjXaCKmFGCsUaIQZ0bUuWs3FWjAZmWfHDNH9IwA9smhFYXlaYCAZWsM4tMcjCcKor%2Fd%2BYJsHXb1usicgjtEg66a4Kfs%2BGxYFCftbhaW12WPHSYze%2Bv4valkwJw%3D%3D&use-server-side-rendering=1&pcode-icookie=hBfMxrlCJsvZwRFdz5M6oVic8U1DoyA4M%2FdUFHoHu%2BGgGo5zQaExrB4ZqPeu2GETg1R26dCXX3m1tjLeL5hCIdnnEaQ%3D&top-ancestor=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2936&grab=eyJncmFiX3ZlcnNpb24iOjIsIm9sZF9ncmFiX3NpemUiOjE2MH0KEqWksOS464EwUGcF5g9qy6LGMbwAvwB-Sjn5UE9CaUIbDZkz0urbOW9Ld1lGS_CW4NXmfD4oSiugzwxwhTFmpoP4TZ82VePWmYiZCTNmzCBjxsh04HXSgT4UIxmyIX5AGEMxO9mQdtIOZai7ruPPFxQP6VAP-RDPgTmULyA6-a578WSW5XRmGYXF5KM1ksMNDCAefFUnGMr5vLlWwPUPsF0_lA8leaaBuYW_VjXU84Wep_LBTlbymJedHPfiCdc3QL1QModod6I38H-ztGt_m-53DtSjtXJgdu0tUncoB_EU7zqYtx_0T6YdqE-7Trb8h-QG9NhSi9XtsdkLh9uT5qnV7oaPznpCbY_HYk-LaS4sdlhhh91AbcxNaZ6Zw5M6M6d2cworPDS_R9rxn2Hl9AcfIMeOP5T0qMY__LU5QRlNcd05HrXl8yUg_WDJkM8XlT1fMto5cLebGL_vuUteCG1HeFonyNHn1sUtOlL4_l8D9LtTcUT8MOpO9IMraMMhfmpQ2KFCz4wOgwBN1Ei1g57DQQUmZcubm4hv3lAjDmfmgOr2OHIYk9paGAywwk66Oup00kE3FqYwr1CamZyFkU8qLZxWO5-sMYPOJ09tt1pfmtway1tzQ_ry1tztKQQk6ay5mSLsBgjMAPxpLpqBYNATKn6e44Y8F7w_yOPuru8EiOWAvc3-S-61n-geVoFY0PbL81_9_0QMi5rfkAwMxHLCiglRyCVEbuXu2DTmlLZrnsFUmN0DfCf4l9yTk05Ee8P9kbWduPSElj9XE3ZX6FexAeJ4c5fLllkddmOYrUhuNtuNL2EvjFQ5NHY8LUVu5hG7q3GtaVIu139QYJOwgxllFnYL8XOM05DEzq1BXPSKGXRmqQCDwv4JeVvsZnIBztacA2dXntotN0wj0ZjvSVVyGEAL_9rIU_DUUXbx43R43MQeC3Ozj9xuzQBygBs4IAUm1qNF2ANnYHODt3-hyowWLooannipbfeFE0COKAyZcbE4UjjfYNvSaAsIBe8siyZOy1dEpFP8rz0B3iWmzJAa-M_RaMjP9xh6ADsacgIuF3UGY3Fs5Vmw4etqLWKL2wV5PFZPM0uYf6UzNU9-vm0lD9rF3ftOinj2tl9htiOsUGXwisymueJj8hEv0s9E9XHd4mF7EVK-SRxFWiAe2ZxUufHLCXVmJbeYI6J505AaczPlDwP--y5rWSDox6uKx7XSx69bYDmcD-l9eAuCbPNr8ed0-t-zmEt0SMCQR9wU9Jd-f-kNIo2cCwAxPgSyHwK_CO0nXczyKDB70suKkpamYH2bCRvy_xiRbMiiPQnM72sN-vQE53DSL7gcSn-JbORtXm_pDTAOxdJD4Wz-n7SQqQWgJBsfXfalPzmID0_aIV9EySxn4VzONHeXC1GGCh4rD-6943chuPKAUNL4ywBsxlNY-hTNVuOPF2oOKd9g9SolE91HiDyor4QB8o0W1UoT6UFAbQFSP9C6uPHaeX6f8vBDxF00vpLGx7gRS28ELvaMqpgjG_rPXqh1rwL1WJL4sGXEu06OlelkRbG_KlLm4veVAT_jVCw91Xk6koH5LKM9u8pl-yMbsBwz91ZuxMyR5-DWDEJxboqNRc-7sMVH_K1LIvxDvKdJNj2Rt0XnmdGtKf8Tm3OZREtvfKWPhvENln6Du8gyyXs-El1siR4JgQCWnIoqN0_gCip7tFpEU3rhMA7H0sMBthtUsTep4z_Csy420UYkssvgaz1dMyaEL8y1-GxUsLbbM6U1BwX6ZnfJpzVXF_UN6WCah2BXV_3TGtA1YP0lzp3-bdDCXwIuaDpbi_vBkG3SHSkW9JWXcTOyGFZic6y1J5Ht1xWdKDYVAhASmAHh6aL4zV0zzxzVtd8P0q6LVkG8fyzGt1gZIFY1_SeS2XIz5sh2IDyWxag5wudRYNfYokf4pXB2p7gmJrstqb0-a-WZiqSR0pKgv_TBLoPAMw7EQjflZfBojfBOo162IWGLLJT0pzqLeRrIZ6dXNNVZskWi0H8ySKcZi_rQkkutmcNcqN58_8O-s3AnLSpqxsLNTBHuEcfaoE8pzJtBd4JO2DURfI1-f-n3Mr7A0i9AXOLYmnphw1U8KZOkNsJ0SXmjYFXLsOTwVieKVkbUn5boqpIjwdwAXI1AND8Y-COVAZD2oHMzXzhg0KF8mE_Cac2oKZBV_DYVlLm5SDMjv5ZvlTpFuaY2XZWrK2ChgnSARx_azyPv45H38sjT8MjD4VZd5tNx5qa5oOJZaoeWTl4IuqpbajotdYLYQ6NoESCK3jT9XE22TnpKauqmoKWcn2mptqaqm3aVak34kpbxV-U1wv39OgFhzgFw040Sx-HW1TLpgqwGcQ7cWFHqAskhm2uRIdkSJYl10lYX_GE7SbvpFzni_eTPLK7HwVg8978TVDj62r_DVdWtzVHkq11UNYyev2hjGnmj3FWg08zWoahcXZfPbyanvzYnsSpq63uySoe6p8_2sBZhnv61TjYlLt36B_FrlDE75B1WckZX1W_8lGI9thtfENVUN7k-1s7ctJyVcWk9IZPbY_O74V_RxhP6xfdyzSkmLzJRPfaCqlPnIFqv_oWpe-2mXiw9McK79NGsQ5pVeT_ZUINwlalkjehlv_uil4uz9Xc9xaVA4kpqyrgLCsEb8yq3bA5f2wjptMgUn7avcm9TI1qHODHtfGREcFNM9aQ94SqpVrjwF2j3dQ-PfzRYklj190Ni2gvOJ33NPqWUpmP20x-jBxrqLznrzDf55MVCywVRc4AIYvBjVFG1SJaQmw_95rrcPGlqQjdsPKZsz7rmM0kbTNv2LlRMRbRmdDmiJmmGMPq5jZQ1x8lxfOh5toNF61s1EXMRC6d3_x_nP_uUMwD8&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

761d7adb1425097064e27e45fdf3965ba9954c5cdbfcd463873ad19994d7a9c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Sat, 08 Jul 2023 14:34:56 GMT
x-yandex-req-id: 1688826896193496-161296540719993757800267-production-app-host-vla-pcode-192
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 210 B
252 B 882ms
315ms XHR
application/json 213.180.193.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=1642868250&pr1=650830518&dl=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=&extid_tag_loader=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-07-08T14%3A34%3A55.420%2B00%3A00&pd=8&pw=6&pv=14&pdw=1600&pdh=1200&ylv=0.801529&ybv=0.801529&ytt=418364174761989&is-turbo=0&skip-token=&ad-session-id=218501688826895379&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1015%2C%22top%22%3A107%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A2%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=801529&p1=cmaon&p2=gxvp&slotNumber=5&bids=W3siYmlkZGVyTmFtZSI6ImJldHdlZW5kaWdpdGFsIiwiY2FtcGFpZ25faWQiOjgxMjk1NywicmVzcG9uc2VfdGltZSI6MzQyLCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiMzk0NTIxOSJ9LHsiYmlkZGVyTmFtZSI6Im15dGFyZ2V0IiwiY2FtcGFpZ25faWQiOjEwMzI3OTUsInJlc3BvbnNlX3RpbWUiOjQ4MywiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjgxNjAxOCJ9XQ%3D%3D&utf8=%E2%9C%93&pcode-test-ids=769344%2C0%2C69%3B801286%2C0%2C9%3B797746%2C0%2C31%3B780721%2C0%2C3%3B789403%2C0%2C91%3B794317%2C0%2C89%3B798346%2C0%2C56%3B795747%2C0%2C46%3B794562%2C0%2C32%3B788873%2C0%2C90%3B800949%2C0%2C25%3B681845%2C0%2C54&pcode-flags-map=eJy1WNty2zYQ%2FRc9JynvIP0GkiCFiiRYAJSsZDIYNVYddXzpOE6aOpN%2F7wKkZVFWITtx%2FSBTlPZosZezZ%2FltMsdCiSlbKJyrCqekUgXjijYqxU1D%2BOTk3bfJl9XF5%2FXkZCJ5RyavJrfrT7f0DN5Hke8HaPL9%2FasHmJazvMukUKxRLe4EsSIgNwn8HoE0OK2IIhmrH0AqKqR2Zk5zwvQFfJoyhXk9gl1%2F%2FWsPNfRDg5pTYWAz1jVScZJTTjINidvW7pnnBIG3PRscRNVdJSlnVQVojdQXhKsFltmU5ErSmihWFIJIO67vOWgvZpJKcBE3uUpZvtSZaDHHNZGAn5MCw%2B%2BOMAtciTFogILoAZQTyZc6AQ2RC8ZninDO7KlEYRSgZIswJENkGF4rOoPLjs%2FJEhAX4JKgZWOHixzko0dwP4NRsaZURYVLHbOuyhVksFoqMaNtH%2Fw5rroj1YYiFEdbRMhbNoOiX7JOKlExeKFvCeSga3LMKRFHwGI3cMfukdO2dxEKOCNCULgHH0p1Wld2sNh3A%2FR0MJUuIai5Ektoh5eHxnmuatrfzyomoL5TjrPZsZD80CkylhPV8erJ2DrbOmUtJ6YbH%2Fqyp4nh8xGc68DfCC%2FxE%2BQcwUu7ooAeJHUrl9AGNd0HfTbivMU0f3kPiw6ufxS10VT9wp7%2BB%2BZP5ecw5v8XgR%2FNvuF1aRhvTrigbMxzKIkTFO3axo7rDUy3hClAThXvVM5qTBvbmAsd5PnRQTMFc09ymlrNPdeJgsFcW%2FYmClcLvBRWS5jZSU99relemIeCNNJuE3qOM5rJwyzOBLcaJi6KezdNanpdorqGFhR4iTYwJQucETtG7A1DVw8fTgpOxBQIqqSZzS5yY38IERyxoLzWlMWBeXXFgU6CoklpboWAKHvu6NygJTguIV7DBNKlKzJOSKOEaO3%2BJG4w%2BIOhQlkz%2BIILrRVooVUDHAvnxO4UipOon%2FZa2BQw7JochmlvD%2BWzr47s9unMTE5hQjKWanaUJHDQFqUiIHwAwSrtoigOoj6cO2ErOVAVSIqZZHa%2F4yhw%2Fd34GWWkFlMA2cFrQAuYhJcd17Ov09IxI3RuDytynQD1upNz1Vea7HgzpCerKGRbTjnryukRWQxIfXwr%2FHZpMqpMq%2B2afZv8sb798LFe3ZxvriYnbui8mlxe%2F765WIsPq4vN1fnkxPs%2BQg2hDQyqqDGX6reOdMRM6LTCWgoBA%2Bz%2BwLvJ5Wpz8ebmM%2Fj2z%2BrqbP0Vrn%2FZXK7O159Gt85Xl%2BbO2d36qv%2F66svm9rq%2FvHyz8%2BbsajPc1chbBLhxs7q7uL77OHx8d9P%2F%2F3yzenO1%2FvvToy%2F8ubq%2B3BjT94eP2GAJ%2BVI14aV%2BzSlWEpdWXgNt7g3FZdqCQO45wZkECj9iGPpOvyyA%2Fr%2FX7KDi4aebrk6JleFQ6PrD6DAbk9lOwBKGUkqyviPnVFDgjiMwyOmrb1DIGXAMJ8N6YVYL3dpAYs%2FrU4SgTd1dYO2kkMuKlB2gvCRqyrjmMwaDE4T5syEjEIk9pGhBxdaa4ktDujQv8IECJ3nhYeRFr11SeK%2BDIMOv0zRPX%2BcZ9vw4JiQK83GFxWGYDHN%2BvJTu8IdkXTbtWUSrZ51JEARcs8ivMPKOsAiQVBCbXyg5Tj0dBBgyOeDi2kpvKEaBGx3yzayZsDZWqe7zFl7gjtR%2B0YbKA%2FvhI%2BQgCN0x8s55TeZoqbCA8hdmGFjREhca5kgMNWYmsVmLt88mhsXb3owH0HdwK1pOJbAwqZ%2FqI3D5%2FQILVWWWF%2FADKtQqeFACs8o7ADAQ05MgknCAgO2pZn18VcsElfuqcs8UJGU0qKbnPFgpGNOTqqCnR2o0SvxBiOBc5LP5HsNpRRs%2F0rjD7j0EoIAjDRrQHgRgimj3JJy0BEvDDXrG7h3hvrhHmB%2Bubi%2FG9Qza2d0F1Ujbvngm7TyA6aKd5hy2ZV1lDey7Yzf2vQAB5G9laSHUgsqpXkjMvLJHJfBdNJbTvf7pFTEUu3k%2BZceI%2FSGypoG5bjXaCKmFGCsUaIQZ0bUuWs3FWjAZmWfHDNH9IwA9smhFYXlaYCAZWsM4tMcjCcKor%2Fd%2BYJsHXb1usicgjtEg66a4Kfs%2BGxYFCftbhaW12WPHSYze%2Bv4valkwJw%3D%3D&use-server-side-rendering=1&pcode-icookie=hBfMxrlCJsvZwRFdz5M6oVic8U1DoyA4M%2FdUFHoHu%2BGgGo5zQaExrB4ZqPeu2GETg1R26dCXX3m1tjLeL5hCIdnnEaQ%3D&top-ancestor=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2936&grab=eyJncmFiX3ZlcnNpb24iOjIsIm9sZF9ncmFiX3NpemUiOjE2MH0KEqWksOS464EwUGcF5g9qy6LGMbwAvwB-Sjn5UE9CaUIbDZkz0urbOW9Ld1lGS_CW4NXmfD4oSiugzwxwhTFmpoP4TZ82VePWmYiZCTNmzCBjxsh04HXSgT4UIxmyIX5AGEMxO9mQdtIOZai7ruPPFxQP6VAP-RDPgTmULyA6-a578WSW5XRmGYXF5KM1ksMNDCAefFUnGMr5vLlWwPUPsF0_lA8leaaBuYW_VjXU84Wep_LBTlbymJedHPfiCdc3QL1QModod6I38H-ztGt_m-53DtSjtXJgdu0tUncoB_EU7zqYtx_0T6YdqE-7Trb8h-QG9NhSi9XtsdkLh9uT5qnV7oaPznpCbY_HYk-LaS4sdlhhh91AbcxNaZ6Zw5M6M6d2cworPDS_R9rxn2Hl9AcfIMeOP5T0qMY__LU5QRlNcd05HrXl8yUg_WDJkM8XlT1fMto5cLebGL_vuUteCG1HeFonyNHn1sUtOlL4_l8D9LtTcUT8MOpO9IMraMMhfmpQ2KFCz4wOgwBN1Ei1g57DQQUmZcubm4hv3lAjDmfmgOr2OHIYk9paGAywwk66Oup00kE3FqYwr1CamZyFkU8qLZxWO5-sMYPOJ09tt1pfmtway1tzQ_ry1tztKQQk6ay5mSLsBgjMAPxpLpqBYNATKn6e44Y8F7w_yOPuru8EiOWAvc3-S-61n-geVoFY0PbL81_9_0QMi5rfkAwMxHLCiglRyCVEbuXu2DTmlLZrnsFUmN0DfCf4l9yTk05Ee8P9kbWduPSElj9XE3ZX6FexAeJ4c5fLllkddmOYrUhuNtuNL2EvjFQ5NHY8LUVu5hG7q3GtaVIu139QYJOwgxllFnYL8XOM05DEzq1BXPSKGXRmqQCDwv4JeVvsZnIBztacA2dXntotN0wj0ZjvSVVyGEAL_9rIU_DUUXbx43R43MQeC3Ozj9xuzQBygBs4IAUm1qNF2ANnYHODt3-hyowWLooannipbfeFE0COKAyZcbE4UjjfYNvSaAsIBe8siyZOy1dEpFP8rz0B3iWmzJAa-M_RaMjP9xh6ADsacgIuF3UGY3Fs5Vmw4etqLWKL2wV5PFZPM0uYf6UzNU9-vm0lD9rF3ftOinj2tl9htiOsUGXwisymueJj8hEv0s9E9XHd4mF7EVK-SRxFWiAe2ZxUufHLCXVmJbeYI6J505AaczPlDwP--y5rWSDox6uKx7XSx69bYDmcD-l9eAuCbPNr8ed0-t-zmEt0SMCQR9wU9Jd-f-kNIo2cCwAxPgSyHwK_CO0nXczyKDB70suKkpamYH2bCRvy_xiRbMiiPQnM72sN-vQE53DSL7gcSn-JbORtXm_pDTAOxdJD4Wz-n7SQqQWgJBsfXfalPzmID0_aIV9EySxn4VzONHeXC1GGCh4rD-6943chuPKAUNL4ywBsxlNY-hTNVuOPF2oOKd9g9SolE91HiDyor4QB8o0W1UoT6UFAbQFSP9C6uPHaeX6f8vBDxF00vpLGx7gRS28ELvaMqpgjG_rPXqh1rwL1WJL4sGXEu06OlelkRbG_KlLm4veVAT_jVCw91Xk6koH5LKM9u8pl-yMbsBwz91ZuxMyR5-DWDEJxboqNRc-7sMVH_K1LIvxDvKdJNj2Rt0XnmdGtKf8Tm3OZREtvfKWPhvENln6Du8gyyXs-El1siR4JgQCWnIoqN0_gCip7tFpEU3rhMA7H0sMBthtUsTep4z_Csy420UYkssvgaz1dMyaEL8y1-GxUsLbbM6U1BwX6ZnfJpzVXF_UN6WCah2BXV_3TGtA1YP0lzp3-bdDCXwIuaDpbi_vBkG3SHSkW9JWXcTOyGFZic6y1J5Ht1xWdKDYVAhASmAHh6aL4zV0zzxzVtd8P0q6LVkG8fyzGt1gZIFY1_SeS2XIz5sh2IDyWxag5wudRYNfYokf4pXB2p7gmJrstqb0-a-WZiqSR0pKgv_TBLoPAMw7EQjflZfBojfBOo162IWGLLJT0pzqLeRrIZ6dXNNVZskWi0H8ySKcZi_rQkkutmcNcqN58_8O-s3AnLSpqxsLNTBHuEcfaoE8pzJtBd4JO2DURfI1-f-n3Mr7A0i9AXOLYmnphw1U8KZOkNsJ0SXmjYFXLsOTwVieKVkbUn5boqpIjwdwAXI1AND8Y-COVAZD2oHMzXzhg0KF8mE_Cac2oKZBV_DYVlLm5SDMjv5ZvlTpFuaY2XZWrK2ChgnSARx_azyPv45H38sjT8MjD4VZd5tNx5qa5oOJZaoeWTl4IuqpbajotdYLYQ6NoESCK3jT9XE22TnpKauqmoKWcn2mptqaqm3aVak34kpbxV-U1wv39OgFhzgFw040Sx-HW1TLpgqwGcQ7cWFHqAskhm2uRIdkSJYl10lYX_GE7SbvpFzni_eTPLK7HwVg8978TVDj62r_DVdWtzVHkq11UNYyev2hjGnmj3FWg08zWoahcXZfPbyanvzYnsSpq63uySoe6p8_2sBZhnv61TjYlLt36B_FrlDE75B1WckZX1W_8lGI9thtfENVUN7k-1s7ctJyVcWk9IZPbY_O74V_RxhP6xfdyzSkmLzJRPfaCqlPnIFqv_oWpe-2mXiw9McK79NGsQ5pVeT_ZUINwlalkjehlv_uil4uz9Xc9xaVA4kpqyrgLCsEb8yq3bA5f2wjptMgUn7avcm9TI1qHODHtfGREcFNM9aQ94SqpVrjwF2j3dQ-PfzRYklj190Ni2gvOJ33NPqWUpmP20x-jBxrqLznrzDf55MVCywVRc4AIYvBjVFG1SJaQmw_95rrcPGlqQjdsPKZsz7rmM0kbTNv2LlRMRbRmdDmiJmmGMPq5jZQ1x8lxfOh5toNF61s1EXMRC6d3_x_nP_uUMwD8&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

213.180.193.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

d45975c8e3cceb32474b06a1125992532ae8cf0302f1a2a266460389e9acdde4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Sat, 08 Jul 2023 14:34:56 GMT
x-yandex-req-id: 1688826896201811-231257779674805372800251-production-app-host-vla-pcode-198
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362
https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362

753 B
1 KB

133ms
132ms

Image
image/gif

88.212.202.52
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

HTTP/1.1

Server

88.212.202.52 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host152.rax.ru

Software

nginx/1.17.9 /

Resource Hash

a61735542ef93f832ab8321f9670a83ff11f58b5e122b2fb014199e32de05312

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:56 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 753
Expires: Thu, 07 Jul 2022 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:55 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.6283898017136362
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Thu, 07 Jul 2022 21:00:00 GMT

GET
H2 200 hit
c.hit.ua/ 471 B
739 B 582ms
140ms Image
image/png 89.184.81.35
MIROHOST Web hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.hit.ua/hit?i=84925&g=0&x=1&s=1&c=1&t=0&w=1600&h=1200&d=24&0.07330310432887166&r=&u=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.184.81.35 Kyiv, Ukraine, ASN28907 (MIROHOST Web hosting, datacenter and domain names registration in Ukraine, US),
Reverse DNS: c.hit.ua
Software: nginx/1.17.9 /
Resource Hash: c78393c6b017e4cc22d2f1f3c60f1134f6f68604026c9c076abb99c7f669530d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="UNI"
pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
server: nginx/1.17.9
expires: 0

GET
H2 200 watch.js
mc.yandex.ru/metrika/ 39 KB
0 3336ms
2415ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Wed, 05 Jul 2023 16:40:28 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "64a572cc-ea44"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 59972
expires: Sat, 08 Jul 2023 15:34:56 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 79ms
24ms Script
text/javascript 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 08 Jul 2023 14:11:08 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1427
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 08 Jul 2023 16:11:08 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 103ms
44ms Script
application/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
652 B 96ms
96ms XHR
text/plain 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=876136022517407&correlator=69881766629268&eid=31075866%2C21065725&output=ldjh&gdfp_req=1&vrg=202307060101&ptt=17&impl=fif&iu_parts=21635236099%2Cbookmp3.ru%2CM_Interstitial&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=1&adks=218515113&sfv=1-0-40&ists=1&fas=8&sc=1&cookie_enabled=1&abxe=1&dt=1688826895494&lmt=1688826895&dlt=1688826889888&idt=5575&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

264ced8b72302036751497f0c2521369597135c9c9b4228513cd3050cf0e4bc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 622
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3289 6 KB
3 KB 121ms
45ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 14:34:55 GMT
expires: Sun, 07 Jul 2024 14:34:55 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/ 37 KB
13 KB 26ms
25ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl_page_level_ads.js?cb=31075866

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

692a83221617b74acc8198b565bbdfa0365248f5df89578d6115382cc9508260

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 15:37:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82674
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13144
x-xss-protection: 0
server: cafe
etag: 214775750626095190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 06 Jul 2024 15:37:01 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/ 344 KB
118 KB 82ms
78ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78ca6c9893f38b97721f9ca4e70fae4a53f1307392793b1ddd6fa3e1a3c7f6ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121028
x-xss-protection: 0
server: cafe
etag: 17629910979258751947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:55 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230705/r20190131/ Frame 1165 10 KB
5 KB 85ms
24ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230705/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 70318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Jul 2023 19:02:57 GMT
etag: 12368291122986407432
expires: Fri, 21 Jul 2023 19:02:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
255 B 39ms
38ms XHR
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=121071666&t=pageview&_s=1&dl=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ul=en-us&de=UTF-8&dt=%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAEABAAAAACAAI~&jid=756666256&gjid=1656250120&cid=42320924.1688826895&tid=UA-109514583-1&_gid=1262657789.1688826896&_r=1&_slc=1&z=918254461

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

bc4540a14193a6537e0c03127bbf19848e6226bd437f2550d18f1f385c55eccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
76 KB 121ms
61ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XR25G8TDFM&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b201bd33880b35f05bd7e086eb6cb7e31f00b7dd5a5b1e72859b2b3c0bd7c375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77911
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 08 Jul 2023 14:34:55 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 214 B
551 B 96ms
38ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&callback=_gfp_s_&client=ca-pub-1618592205083780&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b15faaef64b833032bddedc75043c4786df2996b60e33467bdfa93775ee3a9cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 43ms
42ms Script
application/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AB76 37 KB
16 KB 191ms
189ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fca784c22034299fcdf5c3249c794d12a1c0db13b37f4fc6152dda09929cf0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 15810
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 14:34:55 GMT
expires: Sat, 08 Jul 2023 14:34:55 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 38ms
38ms Image
image/gif 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=b-topbar&ign=false&pw=1600&ph=1200&x=800&y=0

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0C1B 343 KB
39 KB 490ms
489ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&adk=1812271804&adf=3025194257&lmt=1688826895&plat=2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ea=0&pra=7&wgl=1&easpi=1&asntpc=1000&asro=0&easppi=1&aslmt=0.4&asamt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895561&bpp=2&bdt=5673&idt=153&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&prev_fmts=710x178&nras=1&correlator=1753909160374&frm=20&pv=1&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=166

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8deb7a7a15c7125927a0c8a8d56a5a96b2bb1573111d5d0bd1527e2eb9f4a5ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 39585
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 14:34:56 GMT
expires: Sat, 08 Jul 2023 14:34:56 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 40ms
39ms Ping
text/plain 2607:f8b0:4006:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XR25G8TDFM&gtm=45je3750&_p=121071666&ul=en-us&sr=1600x1200&cid=42320924.1688826895&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBA&ngs=1&_s=1&dl=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&dt=%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&sid=1688826895&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XR25G8TDFM&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame EB75 119 KB
43 KB 124ms
51ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZKl0DwALebkE0aHBAAzdu2-ETap1CRwQWStTwg&u=%7CPEJmSnDN9WO8SHHdp7rMZXutkU%2B5BsN8Hi%2BjYnjr54w%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92IuRSFNw2pJuXDhXMlF90dLRZUzCRxD8k1bbz4FCjqio5rpmo1xONCOSE0EVUqQbmEf__gHRiFwaY_lD7sap4KQhjkKFgAAkkRnSoXfjfMkW4A_zDmMZrG0NLwUa2gADbX_iOSexosnPAOP8NUiL0R6pysuFVZyMI7meLgGZzcQMIK61i-bptMhvQJbCGj-GTEGnQOwIN91NrCRlYiGbZw9lhFrYaU1XJ5979slhLLpC4LpkZ-YVa10tP1XbqzyCHMLKVPODdDE5PVoqArZDy65bSQUh1Tn6-mLxAwuvM6dtBjXBJq3hN7DusW7UcAxAkYc9kQ9MQ4G1bdl_0Mx5cV8QNzwLAjJcXSvFUzm3jp2pK4aHWbJdLT4fdBmKn2NxdnWiND7yYmiR66OXqx-RdBCJ8ZBpjdM67sSAUBgJVLxG85JPUQ5rQ3Cv15ZeFAwxp2R9YHSnPX51i4HDJq-a3476MoJ7a03vJrEYHfI837jIvVzCGcbtaYbaTODO27PH2Cpte-u8WCQRusNbmKL7La9VPquV3d580Tw79BgBCZC8hVF-Y0C7Lzk&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxdE5D3SpZLnzLcHDxtYPu7uzuAacge-wXJKat4ynAcCNtwEQASAAYMnujovApIwQggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBKMCT9Cy4Hmrqe91USTPYkdtAyYq-FbpQOH_EJl-qvDBueQgMH7XqxTPBLyburldTIE4o6mCrK79zeCY33xBYPCqogXIUrRzh2Wof-dAJ26sibBgpbiOwLEome-k9UWpFUTB5rQeushq3B2N90p4AJqTAssELqb3tS6ImMPNsV7QyUlReWp9vOGw0TSDeBqdAdk3IsoJTkn7jA7v_pKdHM7MYyt7d9p3A4dzwOanB-7t485Fz-97MKp4NqxneAal9nWXHGh8d2UqPN5MpTus4HerMMecoMgOsPTvk18YDL9KPThM6HP0mOOGhgXswUWqs-h93uXEzWciHvHNGQkBrb6a1EJjAqYXtp23fSEXQJCXSXLlH23Cn5f-xvnbPq1OvvtDi4ofgAaT5fKutKKC5iqgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2twZ858gAViSkZCUzuXrpP5OekFQ%26client%3Dca-pub-1618592205083780%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

96074263b0587e003f4ad803f27e39f93ac2a578511a9edbe0514b8705c909c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 14:34:55 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=hrQtqsvE37beyfJhxwyipi821FmBf_5CbMRrwofyajksO4z28veU-xTCSYZ5Klse6WJ_5FHBA0tIRo_Kh9AI6JPGn_Gcu8Ynm4nbWXuo8-QfWIAcKn3E9bwqK2nd3mjO1tRSo-uwCgxoY343jq2zYXKzRqNaaedK0ZA9FJWPBwmZvgQowc82dSpC2PzdrfxPxq7vwW5cXunvu17CtnViIDQoZisnjABuwYmIHqAdqAfaOeEbWJNMeRntoBnU2DiW2IfgVA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 15226573
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame AB76 3 KB
1 KB 40ms
28ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E727 1 KB
643 B 26ms
24ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 22804
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 08:14:51 GMT
etag: 48472445140208031
expires: Sun, 09 Jul 2023 08:14:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame AB76 20 KB
8 KB 32ms
24ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame AB76 0
0 101ms
43ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTRmz3gJmUfAGu3Bx7HUwd1lu9Gk-DqV_s6ZrZos5TO74AoviiS_ov8r0RPrytEqIal0BoIQZRWgnCt3OWZj74LZrSw_A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AB76 179 KB
57 KB 126ms
59ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bf958c032ce083c26ae980ed92d0360c971e87c183d6bd988e770fc172786c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57266
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688579601580341"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_cver=1&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbO...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=54b7a75cae7f21c6&is_secure=true&networkId=14000&version=1&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_cver=1&google_push=AaAOQGFBk9BX...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHSH1MP99UfAN4Ri4VAAAAAAA&expiration=1688913296&google_cver=1&is_secure=true&google_gid=CAESEAiuqqwpWIFZbwrTjAha0...

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHSH1MP99UfAN4Ri4VAAAAAAA&expiration=1688913296&google_cver=1&is_secure=true&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbOFCFpMUWMdHHuHp2okZ12aUjIAlN1M1VvI5CxtILwRqduBtjR3

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAHSH1MP99UfAN4Ri4VAAAAAAA&expiration=1688913296&google_cver=1&is_secure=true&google_gid=CAESEAiuqqwpWIFZbwrTjAha0C8&google_push=AaAOQGFBk9BX0oBspi5f5xPTbmLEUqh_CQrQ1tzHvMGo0KJm_3AQnbOFCFpMUWMdHHuHp2okZ12aUjIAlN1M1VvI5CxtILwRqduBtjR3
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEPfAhBxGshZ5XrCCfb08Ap4&google_cver=1&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ&google_hm=Q0FFU0VQZkFoQnhHc2...

170 B
232 B

43ms
42ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ&google_hm=Q0FFU0VQZkFoQnhHc2haNVhyQ0NmYjA4QXA0

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
via: 1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AaAOQGGgAT4feTz-INTMvUL63A7-ZZoqfyY26xRA_3oSamD9Di_rClbZ0j79zCbqzLMEJEL0U52tiUDler7M-MPWC9RWzPDnlkUZcUQ&google_hm=Q0FFU0VQZkFoQnhHc2haNVhyQ0NmYjA4QXA0
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: Kvt2BU5cjTtkxKSMOoX5I9Uxmuut-mGKSy1rV6kDxO8DftfOMxmZMQ==
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=OThlMGNiZjMtODEwNy00YTc5LTkxNmEtMzgyNDFlNGIzYWQ3&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=1&google_push=AaAOQGFV...

170 B
188 B

45ms
44ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=OThlMGNiZjMtODEwNy00YTc5LTkxNmEtMzgyNDFlNGIzYWQ3&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=1&google_push=AaAOQGFVKlz6GGdLvtw-oPG5087XSkr5mZWCZ3L1BFEpvqmcFY8qTuxf6BZGxxnbXe5gb3RdFtbuqlNE9GjeXX7ez1WqTWeXYjDKJDUV

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=OThlMGNiZjMtODEwNy00YTc5LTkxNmEtMzgyNDFlNGIzYWQ3&google_gid=CAESEMsepfupmSHB-A6-nBc_-nE&google_cver=1&google_push=AaAOQGFVKlz6GGdLvtw-oPG5087XSkr5mZWCZ3L1BFEpvqmcFY8qTuxf6BZGxxnbXe5gb3RdFtbuqlNE9GjeXX7ez1WqTWeXYjDKJDUV
date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcELrnYQAO3BhvJq2qQXcF3t64px542uY89w_X4GKVnHQuzzfCeTSIO...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Qg20Gp5F8-NqwhJMKB0ta4&tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcEL...

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Qg20Gp5F8-NqwhJMKB0ta4&tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcELrnYQAO3BhvJq2qQXcF3t64px542uY89w_X4GKVnHQuzzfCeTSIOBoeGLSq7A7gxKubo

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
via: HTTP/2.0 odnd
date: Sat, 08 Jul 2023 14:34:58 GMT
last-modified: Thu, 06 Jul 2023 19:12:49 GMT
content-type: text/plain; charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Qg20Gp5F8-NqwhJMKB0ta4&tap=gAds&google_gid=CAESEC_v4UHqqQUoZC-yG7W0UB8&google_cver=1&google_push=AaAOQGHiQyF0-TLmMUcEeo-X46uOP3UajcELrnYQAO3BhvJq2qQXcF3t64px542uY89w_X4GKVnHQuzzfCeTSIOBoeGLSq7A7gxKubo
cache-control: no-store, no-cache, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-tb: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame E727 43 B
363 B 92ms
29ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEAAKOSYgibdtohWaqqEeeFA&google_cver=1&google_push=AaAOQGEcJUK7jWLeZ4TUohKgKxSujNSWF1nYx9IWEjpLndpRPfZkrlCEVfFObyHebMdCSbYYpAqAzpaNNkZrqQd9_-cm0jceRc0dE-Ij

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 199023
expires: Sat, 08 Jul 2023 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEJobGn8iQgs3zh6mE9QdVB0&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-m_xxu6OJi&google_hm=MTA1OTY3NTg4Mj...

170 B
232 B

42ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-m_xxu6OJi&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AaAOQGEyWmWBrMXXexBb--_jxxnYS9TmmHUpe9aAVKAji_WhvTErlLDy8SK193f3fP-e1Pi-jawwBT3NPtHMwD7Ow667rC-m_xxu6OJi&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E727
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESECdSqHSFviyN-5R0sKEIuI0&google_cver=1&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRK...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRKZEjPFRAKy&google_hm=ODk3MzU...

170 B
329 B

43ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRKZEjPFRAKy&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==

Requested by

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFXTwagXZjwIOudeXFIthqwLvyb2PlZvzoze279keprzJ6pl2b2gylPPqWD2Y-c2SOro-S3dkK1sTMYWrwiaVzdaRKZEjPFRAKy&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==
Date: Sat, 08 Jul 2023 14:34:56 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame E727 0
130 B 110ms
39ms Image
text/html 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I1zElubpDft_oUa8QoQcHTXcZPxEvuKkwE-DLPy0Is3B7wRJ-h4ZXGXo4ofgA6V4-NahGSTQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame EB75 2 KB
1 KB 95ms
32ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZKl0DwALebkE0aHBAAzdu2-ETap1CRwQWStTwg&u=%7CPEJmSnDN9WO8SHHdp7rMZXutkU%2B5BsN8Hi%2BjYnjr54w%3D%7C&c1=m7oIQCLYgBslArNoBtbzWGPvj6heTG_nq948FPMQexFgSXZ5qfLYlz1Dr0C5Jfeybmk8T_2vGR7Ob23Zd9U92IuRSFNw2pJuXDhXMlF90dLRZUzCRxD8k1bbz4FCjqio5rpmo1xONCOSE0EVUqQbmEf__gHRiFwaY_lD7sap4KQhjkKFgAAkkRnSoXfjfMkW4A_zDmMZrG0NLwUa2gADbX_iOSexosnPAOP8NUiL0R6pysuFVZyMI7meLgGZzcQMIK61i-bptMhvQJbCGj-GTEGnQOwIN91NrCRlYiGbZw9lhFrYaU1XJ5979slhLLpC4LpkZ-YVa10tP1XbqzyCHMLKVPODdDE5PVoqArZDy65bSQUh1Tn6-mLxAwuvM6dtBjXBJq3hN7DusW7UcAxAkYc9kQ9MQ4G1bdl_0Mx5cV8QNzwLAjJcXSvFUzm3jp2pK4aHWbJdLT4fdBmKn2NxdnWiND7yYmiR66OXqx-RdBCJ8ZBpjdM67sSAUBgJVLxG85JPUQ5rQ3Cv15ZeFAwxp2R9YHSnPX51i4HDJq-a3476MoJ7a03vJrEYHfI837jIvVzCGcbtaYbaTODO27PH2Cpte-u8WCQRusNbmKL7La9VPquV3d580Tw79BgBCZC8hVF-Y0C7Lzk&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxdE5D3SpZLnzLcHDxtYPu7uzuAacge-wXJKat4ynAcCNtwEQASAAYMnujovApIwQggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBKMCT9Cy4Hmrqe91USTPYkdtAyYq-FbpQOH_EJl-qvDBueQgMH7XqxTPBLyburldTIE4o6mCrK79zeCY33xBYPCqogXIUrRzh2Wof-dAJ26sibBgpbiOwLEome-k9UWpFUTB5rQeushq3B2N90p4AJqTAssELqb3tS6ImMPNsV7QyUlReWp9vOGw0TSDeBqdAdk3IsoJTkn7jA7v_pKdHM7MYyt7d9p3A4dzwOanB-7t485Fz-97MKp4NqxneAal9nWXHGh8d2UqPN5MpTus4HerMMecoMgOsPTvk18YDL9KPThM6HP0mOOGhgXswUWqs-h93uXEzWciHvHNGQkBrb6a1EJjAqYXtp23fSEXQJCXSXLlH23Cn5f-xvnbPq1OvvtDi4ofgAaT5fKutKKC5iqgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2twZ858gAViSkZCUzuXrpP5OekFQ%26client%3Dca-pub-1618592205083780%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame EB75 2 KB
1 KB 106ms
43ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame EB75 308 B
636 B 104ms
43ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame EB75 293 B
621 B 102ms
42ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame EB75 43 B
348 B 100ms
32ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=-uKmxlSAAgxVRHLviWMrqE8N9pmT29f2lk67WOxmEniKHzKrOpZL00UwdPv0PV77p-fZA0lahKh1aeKjc4VsSuzM5VmtezeE4292MWMaHaJlz3OIuAN96iVuylZI4h0_ndOzA1LcZy72d9vI3fmXVh3OyADcKQaz11IWikaFgNsOyYA70YEGk8YRbeXlJLsdVEZF3rLZyv9IF0Os7PkRH9cociP2ML2YWf9BUs9RG5Qjmy-1xUVy1psPPPCRfygRg_ZvQ8vEvnEOJvDwSFw33E07XhjK6Zi9WjDSmvQZJSdpaxnUwHhJ5T4KayTBhQRRjbF3M6QoP2uz1Zahrla9yEfE7O0hutDDjlkh2M6r9BNOuNoV7hURBYRRcgBcFJikJmMNkpiaC_i_-EB39xZIiw4d1MQ9ENslUrM_hBf6ylM4Gj_mHLN71na4Kk8BCVUnsxx7Dg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3080766
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame AB76 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 96f7c3008354c54c1f51a896fc93ef08cddd0a3b6bf778295b6ef7204011373d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame EB75 12 KB
6 KB 43ms
41ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame EB75 188 KB
188 KB 164ms
96ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?m=0&partner=102266&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F102266%2F4793739%2Fb0d727dc051749889ffeff14565f24b1_407.jpg&v=3&s=3lCy0X8SJttjIFM24kxbw5cD

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ba25de6782659210e549b88fbdc017f9363ac1ee1ee7631b87f44724a0f10d76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
content-length: 192688
expires: Thu, 13 Jun 2024 17:33:38 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame EB75 36 KB
36 KB 128ms
61ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=300&m=0&partner=102266&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F102266%2F4793739%2F1371674528fd4403ab35a736b15beaac_logo_-_boston_brain_science.png&v=3&w=242&s=iDxqxacWjdq9JabDK1QRsKzB

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c02d05ebc793000b84ba256eae55afdf3d265f946a51b61205b5621f43587113

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 36824
expires: Thu, 13 Jun 2024 17:24:54 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame EB75 0
128 B 90ms
28ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=hrQtqsvE37beyfJhxwyipi821FmBf_5CbMRrwofyajksO4z28veU-xTCSYZ5Klse6WJ_5FHBA0tIRo_Kh9AI6JPGn_Gcu8Ynm4nbWXuo8-QfWIAcKn3E9bwqK2nd3mjO1tRSo-uwCgxoY343jq2zYXKzRqNaaedK0ZA9FJWPBwmZvgQowc82dSpC2PzdrfxPxq7vwW5cXunvu17CtnViIDQoZisnjABuwYmIHqAdqAfaOeEbWJNMeRntoBnU2DiW2IfgVA&sds=2&rev=87360&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 08 Jul 2023 14:34:55 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame EB75 2 KB
1 KB 38ms
37ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame EB75 2 KB
1 KB 38ms
38ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 02 Jul 2024 14:34:56 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/ 154 KB
52 KB 50ms
50ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fd9d901d114f9f15d1ace30fc1da168ea215e26c8d08a3c9e8ba609088f25c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53417
x-xss-protection: 0
server: cafe
etag: 5820416250915932830
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 48ms
47ms Script
application/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/ Frame D9BE 10 KB
4 KB 28ms
24ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 69915
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Jul 2023 19:09:41 GMT
etag: 12368291122986407432
expires: Fri, 21 Jul 2023 19:09:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/ Frame A35E 10 KB
4 KB 28ms
27ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 69915
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Jul 2023 19:09:41 GMT
etag: 12368291122986407432
expires: Fri, 21 Jul 2023 19:09:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/ Frame 0D47 10 KB
4 KB 27ms
26ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 69915
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4544
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Jul 2023 19:09:41 GMT
etag: 12368291122986407432
expires: Fri, 21 Jul 2023 19:09:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AB76 0
19 B 56ms
56ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cke0YD3SpZLnzLcHDxtYPu7uzuAacge-wXJKat4ynAcCNtwEQASAAYMnujovApIwQggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBKACT9Cy4Hmrqe91USTPYkdtAyYq-FbpQOH_EJl-qvDBueQgMH7XqxTPBLyburldTIE4o6mCrK79zeCY33xBYPCqogXIUrRzh2Wof-dAJ26sibBgpbiOwLEome-k9UWpFUTB5rQeushq3B2N90p4AJqTAssELqb3tS6ImMPNsV7QyUlReWp9vOGw0TSDeBqdAdk3IsoJTkn7jA7v_pKdHM7MYyt7d9p3A4dzwOanB-7t485Fz-97MKp4NqxneAal9nWXHGh8d2UqPN5MpTus4HerMMecoMgOsPTvk18YDL9KPThM6HP0mOOGhgXswUWqs-h93uXEzWciHvHNGQlDr54If7DqAmWe2xFcB6jU96y_QFz92_Yx5R43eOf3JgSYL_uAgAaT5fKutKKC5iqgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6gAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=rq94Yd4QrHo&uach_m=[UACH]&cid=CAQSPABygQiDBx6gTAgLywcPNzMzznDr0vewXaTxK3nJ3U29C41ksqagfDhHP7_4n_gV1X9bmyAqCUdk6RaMqxgB&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 08 Jul 2023 14:34:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame AB76 0
126 B 105ms
30ms Image
text/plain 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kPnAF836RMYFsgHiIp0XAgAAAIHwBbb3yQw3EA50qWQN1GaYRUyjAH4JAAASAAAKCkFRVURDZ0VCQ2c&wp=ZKl0DwALebkE0aHBAAzdu2-ETap1CRwQWStTwg&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 296491
server: Kestrel
content-length: 0

GET
H2 200 css
fonts.googleapis.com/ Frame D9BE 4 KB
744 B 104ms
41ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:12:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame D9BE 1 KB
850 B 102ms
40ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Secular+One&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6cafba2d8fd7a8d76f356f7f298fc1cf743ca78f9f17f997e9000ba587cc748

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:59:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame D9BE 2 KB
658 B 104ms
43ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 12:54:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame D9BE 3 KB
1 KB 32ms
29ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame D9BE 20 KB
8 KB 28ms
25ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame D9BE 0
0 44ms
41ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSqsoq4ZlGPmBJfmCB3W-mhx0yYmh975AWIUZca4cHuUn6esxdRrUJv3gi16jHvCPDfHAzEbnn190yahOfzziEWUwbvFg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D9BE 179 KB
56 KB 59ms
57ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bf958c032ce083c26ae980ed92d0360c971e87c183d6bd988e770fc172786c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57266
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688579601580341"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame A35E 4 KB
744 B 91ms
55ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:02:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame A35E 1 KB
514 B 98ms
63ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Secular+One&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6cafba2d8fd7a8d76f356f7f298fc1cf743ca78f9f17f997e9000ba587cc748

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:07:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame A35E 2 KB
658 B 99ms
64ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 14:27:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame A35E 3 KB
1 KB 37ms
27ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame A35E 20 KB
8 KB 33ms
24ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A35E 0
0 49ms
40ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4hnfqhsYHzbC_hObKNsfKFBW079AHP2v3bOs-gu5aW9WJWBqlz0A4jDTfpVQziqqMtfU6KwTsZXKbvH1T8OtYyddPeA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A35E 179 KB
56 KB 69ms
60ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bf958c032ce083c26ae980ed92d0360c971e87c183d6bd988e770fc172786c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57266
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688579601580341"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0D47 4 KB
744 B 85ms
57ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 12:58:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0D47 1 KB
514 B 76ms
47ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Secular+One&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6cafba2d8fd7a8d76f356f7f298fc1cf743ca78f9f17f997e9000ba587cc748

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:11:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 0D47 2 KB
658 B 93ms
64ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 08 Jul 2023 13:09:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame 0D47 3 KB
1 KB 35ms
32ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/ Frame 0D47 20 KB
8 KB 31ms
28ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230705/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 21 Jul 2023 19:02:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0D47 0
0 46ms
43ms Image
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRVUiucoKqpJ43zziir_gow0cyIJXvkFzPxof1wV2INFmWosxOmTYRPcxMdDVfPktumud6leLFiyV9BBFpVjKB1lcCMUw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0D47 179 KB
56 KB 80ms
78ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bf958c032ce083c26ae980ed92d0360c971e87c183d6bd988e770fc172786c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57266
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688579601580341"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jul 2023 14:34:56 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2338 1 KB
643 B 25ms
24ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 22805
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 08:14:51 GMT
etag: 48472445140208031
expires: Sun, 09 Jul 2023 08:14:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame D9BE 0
19 B 69ms
69ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CKCg-D3SpZPHNL43NxtYP0K6GoAuLv4iuZvG66fX_DsCNtwEQASAAYKECggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBJsCT9AR3GaKyXn1GnhTqyr2CHcpCa-o7tT7MNPgc3tSYOStyphAKe2813iP_1HhGYXzRMcz-RsVH8V1mZuDNHyvcSBNZ4Fz1FcgVDiYy9aqAEEsT_KJkXgR4J0wPFTuxu8Pis_QTNRPA_g7ywdSDDuHAhg0iiFEu39h8Fv9hc8sFD5eXnJ-sa9LvZJzB4ViIjwjrqCin07PfN79kUG7-jBOUhZhkFoMAJpwDvnUzM1o7eICjPDoYsPYZgzZf6RJZKt3SevGqfnHIniJMOsu9hmqbFeSx3mKiy9glyyxq-S7dKmnJ7vnwihhMPJ1DwMB9GDgYp1mBivkawA1JYl5PrTaUF6rMd8LNFupEkEyQ8r65oMeQntHAZWm2BuZD4AGhrfZus6P1NYNoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOoAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xNjE4NTkyMjA1MDgzNzgwGAA&sigh=bZYccvjC3-o&uach_m=[UACH]&cid=CAQSPABygQiDTOKMflpYx9dnEkWpu6QkmR8p8izSo9vygD8aKKncNXiiIEQhQFDyae4-4zS4ce0gXl734MrkjRgB&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 08 Jul 2023 14:34:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 rtimp
g.bidbrain.app/ Frame D9BE 0
757 B 137ms
66ms Image
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://g.bidbrain.app/rtimp?sid=9bb312f5-1d9c-11ee-ad5c-267fd57a67d8&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=imp&p=ZKl0DwAL5vEE0aaNAAGXUL1ST3pOHI_E4T56BA&im=Z8J0U8g48WWFqME20vQ_owUn7CXPcU1KC30IWmaJC7C7rgLc4frL-2IoyT-k0r6Vk1G38On_FqVoYao1akpmv6-FMG14dXN-wnvZNJZgi2_ejrBLFt9TJxdsXUeq2RJw2NDdfW6jQyywgnzeDeOlA1f2XpnZTQ4mdrihq_dR2qMKyMsYtCu1RQWH8O6Aozzih4sFgind05r6g4QSFsKZTcpRFFH_Nxc_m8Rll94nIPgqqH6x1nqdfY1IQ_U-XX1uRpR7L_wKNG8LGa5IHTrcyK63Fh0HInp_KN8fXZqbwOWCMcwYJrWXGxMpLyV4GmH988AdtqW5xL4sAQ8G3HwKsOzyHFe2lXtg8mldXFdcbf_VWWEss8CXMO1hd8qdgo0YqSo-LQh4qg1J-WNCr1TetQ&cbvp=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 204 ev
g.bidbrain.app/rt/ Frame D9BE 0
0 125ms
54ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.01948615707719714
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
DATA 200
OK truncated
/ Frame D9BE 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 329b369901f4024b8daf7b92d195085e6509a8d7f74f3ebfdee7dad5d1c20093

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D9BE 15 KB
16 KB 82ms
25ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 04 Jul 2023 10:25:13 GMT
x-content-type-options: nosniff
age: 360583
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Jul 2024 10:25:13 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame D9BE 15 KB
16 KB 88ms
31ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 05:55:38 GMT
x-content-type-options: nosniff
age: 31158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 05:55:38 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 90F5 1 KB
643 B 24ms
24ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 22805
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 08:14:51 GMT
etag: 48472445140208031
expires: Sun, 09 Jul 2023 08:14:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7F0F 1 KB
643 B 25ms
24ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 22805
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 08 Jul 2023 08:14:51 GMT
etag: 48472445140208031
expires: Sun, 09 Jul 2023 08:14:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2338 35 B
463 B 128ms
33ms Image
image/gif 2620:116:800b:21:4cb8:1820:80ca:50f7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFzOCfbrGRbX7Le45bq6mZA&google_cver=1&google_push=AaAOQGFwg6BbplpJZnxZmhn9aEcMT3HV3zvl0AxCEX1RRk60ni4IyLi8q6Sc0ED_vzbyQWt6WzxwxtH3eEd5qqd2ItMfcJ4cmQ-drM8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2338
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEAgNxWxrKLX95L7KeEOEWog&google_cver=1&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEk...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEkmHfcnBItylqi4w

170 B
188 B

40ms
39ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEkmHfcnBItylqi4w

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 08 Jul 2023 14:34:56 GMT
Server: MT3 1031 59fd23a master ord ord-pixel-x25 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGF80BswWKCmsSWteBi3m8e8LqlXmcgztQ7_yf2XFtE0PCQkAeODRmdGh6YM70Pb9YtD4jAaIV53te3qFlEkmHfcnBItylqi4w
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 08 Jul 2023 14:34:55 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2338
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESENAB6ggZ5Xx2wbJHf_VmfEY&google_cver=1&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=ijWgU0IERGmrMnwXq40nVg2&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_Imh6bnrug3P3460

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=ijWgU0IERGmrMnwXq40nVg2&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_Imh6bnrug3P3460

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=ijWgU0IERGmrMnwXq40nVg2&google_push=AaAOQGHO9iX_d5WysuFAad141Uchc5dKcvwZr9Swp0IKC-kbln4YgaIxZqf-lVMtG_LyZITvnqZPczxIffpvrQO_Imh6bnrug3P3460
x-host: tde-deliveryengine-production-84d9bf65c-28c2h
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 2338 0
35 B 126ms
39ms Image
text/plain 44.206.49.18
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEM_f86lCDSkpViOOtrOI1P0&google_cver=1&google_push=AaAOQGEGL1i5ul3VIYlOx0Og3GuQW1DGrdb0GRBy7qC0Ja_Uou7MXBYWPL3GsyUN34yT-8VKKX6gON7OytKVNY84OlUWkeD5DtU1S3E
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.49.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-49-18.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2338
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrG...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrG...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo&google_hm=X0JYMlZ0eUV5cmw2S...

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo&google_hm=X0JYMlZ0eUV5cmw2SXZqbzVuQ3M=

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:56 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGEo2Gbc1U8RrmNZopw9263p-7mflu8qsya8IHr-3p2dUN4LICWUsmuM00CL0q20V422uONtYjBeIydrGKEtYTb18YoTMgIk6lo&google_hm=X0JYMlZ0eUV5cmw2SXZqbzVuQ3M=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 239
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET googleredir
googlecm.hit.gemius.pl/ Frame 2338 0
0

GET
H2

200

report
sync.teads.tv/um/ Frame 2338
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESECbOQfbIhMw9...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=YjNiNDJlN2UtMDZkNS00NDJmLTg2YzQtMTlkOGM2MzEwZDgx&google_push=AaAOQGE9LYISRFFQUUHvOZuKUAcCKX2NfPUc3bfovmt3VZWdpjaozpAadEY460sbbO_O-...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

39ms
39ms

Image
image/gif

23.197.21.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Server: 23.197.21.93 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-197-21-93.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Sat, 08 Jul 2023 14:34:57 GMT
pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2338 0
12 B 42ms
38ms Image
text/html 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J-s21R-uKVjbioaIAl8Sk6qJlw9JwcEST7he84j9URps0rgnnfudKyaUvD8mhWVbksgDIf9XY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 204 ev
g.bidbrain.app/rt/ Frame A35E 0
0 53ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.11680218167087486
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 90F5
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95Xi...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95...

43 B
439 B

111ms
109ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7e390d09cb2c4bc0-BUF
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDtY0I-8OqQkx7RfQakGU2s&google_cver=1&google_push=AaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAaAOQGE-R_vnPbEnYGdLdhae--oOpLTReCmp7zYRsDKEWZel7TMVMzD13yCRH5bXXnKckQxyrWuh49WYrP28kxogU7PEc13dw95XiA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7e390d08eb234bc0-BUF
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESENfsGcSNYz8QB0AUfw8rWOc&google_cver=1&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw&google_hm=UjMzNjQ3XzEwNT...

170 B
188 B

41ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw&google_hm=UjMzNjQ3XzEwNTdFQ0UwMF80MkFCOUM4Ng%3D%3D

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AaAOQGFR5XGsXRTRl5TJiDF7hFD8EbFPSRn8XE79BX2XhALLb7JdSFqdhiRESrs5HWYJ1xlksR5kuJLHk8pbN0kyM-SpOWPFyRASCw&google_hm=UjMzNjQ3XzEwNTdFQ0UwMF80MkFCOUM4Ng%3D%3D
Date: Sat, 08 Jul 2023 14:34:56 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-371831635; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 348
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESENrrtOULOg_-etik_5enmQg&google_cver=1&google_push=AaAOQGGbu8-l1AerohuevIX4XiOcIcnpdlzTNP8cgoIu25nKtk_T3LfSXXIMwrdDQebDA_6yL7j67Dx4B_7zJ-rg30...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESENrrtOULOg_-etik_5enmQg&google_cver=1&google_push=AaAOQGGbu8-l1AerohuevIX4XiOcIcnpdlzTNP8cgoIu25nKtk_T3LfSXXIMwrdDQebDA_6yL7j67Dx4B_7zJ-rg30...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MjIyODc2ODQtZGExMy00MTRiLWJjZDQtNmJjZGFiYjFmYmNj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=22287684-da13-414b-bcd4-6bcdabb1fbcc

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MjIyODc2ODQtZGExMy00MTRiLWJjZDQtNmJjZGFiYjFmYmNj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=22287684-da13-414b-bcd4-6bcdabb1fbcc

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MjIyODc2ODQtZGExMy00MTRiLWJjZDQtNmJjZGFiYjFmYmNj&google_push&gdpr=0&gdpr_consent=&ttd_tdid=22287684-da13-414b-bcd4-6bcdabb1fbcc
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEBDNGd5e79k6ndxtTVDhMSk&google_cver=1&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEBDNGd5e79k6ndxtTVDhMSk&google_cver=1&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA&google_hm=R57VnGcQTCmXjwRKJqpXKg==

170 B
188 B

42ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA&google_hm=R57VnGcQTCmXjwRKJqpXKg==

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA&google_hm=R57VnGcQTCmXjwRKJqpXKg==
Date: Sat, 08 Jul 2023 14:34:56 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyE...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyE...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba&google_hm=cENnV0JIaWJ1MFh6WlQt...

170 B
188 B

41ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba&google_hm=cENnV0JIaWJ1MFh6WlQtRFVmdDE=

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:56 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGFIxQ2tZS8HONlQSR0u8dnLM-xoriz-XEMYsrcrIQoGSjehTfRtT2BIZI2aekLqSfHyi4mLX4u_cjQyEcfv0mW3EUIn0hba&google_hm=cENnV0JIaWJ1MFh6WlQtRFVmdDE=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEOlRjI7Tnep0RVE3LTqd9bE&google_cver=1&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySu...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySuI2Ep6aQw&google_hm=ODk3MzU2...

170 B
188 B

43ms
42ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySuI2Ep6aQw&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGEKt1Xs6_xQAcrB_QcWjDwR2fQnb7rQrV3NOnpG4CcWNd7NE8D-mY0oJXSriznWkfJ-7XiC8yoqnWF4VPw4oNejySuI2Ep6aQw&google_hm=ODk3MzU2NTU5NzgwODc0NzA1MA==
Date: Sat, 08 Jul 2023 14:34:56 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90F5
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEPSputcLtwlMl181mtn_eR0&google_cver=1&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2a...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2azOjB1YnCnpx89Btuv_BHFCO9V0jC6xWdeZwnA&google_hm=...

170 B
188 B

42ms
42ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2azOjB1YnCnpx89Btuv_BHFCO9V0jC6xWdeZwnA&google_hm=1GtC-1lgSoqy3HeDNEFOfCM

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AaAOQGENdfFRj0JAEsCFbv1at_zbyr81HSYdK23MD-y0-erw96BI25XfOMqzXbML2azOjB1YnCnpx89Btuv_BHFCO9V0jC6xWdeZwnA&google_hm=1GtC-1lgSoqy3HeDNEFOfCM
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 90F5 0
12 B 45ms
43ms Image
text/html 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnJqhHwxx7cKea21t2QBmhu77qkyOZk6fFBLZpsh5P2u0up-c3xE8i0UH-skTDqQ7zGew2X3Y

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 rtimp
g.bidbrain.app/ Frame A35E 0
303 B 57ms
56ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb117b8-1d9c-11ee-8fe9-36ab3e1c8b08&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=load&p=ZKl0DwAL5vIE0aaNAAGXUNpPLcKglw_N1w5R_A&r=1757084575&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
DATA 200
OK truncated
/ Frame A35E 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 192253b6be78d4a1030337cae32f62341aecc2510252cad0a33d7ba52c9d54aa

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame A35E 15 KB
15 KB 27ms
26ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 04 Jul 2023 10:25:13 GMT
x-content-type-options: nosniff
age: 360583
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Jul 2024 10:25:13 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame A35E 15 KB
16 KB 31ms
31ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 05:55:38 GMT
x-content-type-options: nosniff
age: 31158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 05:55:38 GMT

GET
H2 204 ev
g.bidbrain.app/rt/ Frame D9BE 0
0 55ms
54ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.41885941992422615
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 204 ev
g.bidbrain.app/rt/ Frame 0D47 0
0 56ms
55ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.6702490023598418
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A35E 0
19 B 55ms
54ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cf2nnD3SpZPLNL43NxtYP0K6GoAuLv4iuZvG66fX_DsCNtwEQASAAYKECggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBJoCT9CJwXMdNORptqArcXBeJRS95PRflLe0QYO322IGSj1iLzwmlkFFl3zmr0pWJRxyimiVe6rVaWW2zdVsARPRQg-Edx04zJu7KX3LeTwvJ0xvaNtxHSUeZlIVuIYBShQQXpuMx3CD1dSa2nn6KE0ZZLQjN1AFvu7KY6lkVm6sWa-00kL8rng8L8N5BjqjlQpRkjs57mzrB4UPiX-mGBEcta4f1numtx66nl9R7Ywqt6qheMkAzk_EJbN8dNOoNi1QE_soDDiGgOqYiJST3z7k4RC8iETd6KQuHXKpmagiX-drzlpbBK5_eLwQ7zhIrYutgocQJHquO3TSeKWFXpFP5pIZrUZJitx2wzHZ6jQWstADPqnRQYPwBC1wgAaGt9m6zo_U1g2gBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6gAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=FAsuKuiqEaI&uach_m=[UACH]&cid=CAQSPABygQiDTOKMflpYx9dnEkWpu6QkmR8p8izSo9vygD8aKKncNXiiIEQhQFDyae4-4zS4ce0gXl734MrkjRgB&cbvp=2&vis=1

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 08 Jul 2023 14:34:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 rtimp
g.bidbrain.app/ Frame A35E 0
277 B 65ms
62ms Image
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://g.bidbrain.app/rtimp?sid=9bb117b8-1d9c-11ee-8fe9-36ab3e1c8b08&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=imp&p=ZKl0DwAL5vIE0aaNAAGXUNpPLcKglw_N1w5R_A&im=2fI2gK_UzLo1g6g-3_0q0t606lqm5m7ejhitoGm2hnls_e9rB2SOg3YgESrdVOcmMI2qET248zj_ctYi_ydWfhYkarmXgqjtoedrKy5-T7ud9b5mQ8Gnvqrb8EFyiY3aORXAHLhYIfURMDOWtiwspxqGYbXU3R5EC5vEpXLS8FDhpcPytqdZ0ZvmHuMF9djfppHFXGSJ3EyU4r9MDM_KFCNjsNnS2ujfYavRXtkndMTso2f7iKRd25dd6l56GJfg1Rjfs_JU2PAwUxfLFlMv4TmaAXEJAr37WbfwNX2ntgqdrWNaWU1NjE7CBG8uaPuA9wbbO9Jhpe6VxK3pTfyWVdQJKgg0-0dXkXCMVEESc8DEgliZXE_2j4OLXslF2we5fARTIJcuVgeV9fRWcs_JTg&cbvp=2
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H2 204 rtimp
g.bidbrain.app/ Frame A35E 0
277 B 58ms
58ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb117b8-1d9c-11ee-8fe9-36ab3e1c8b08&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=vw_100&p=ZKl0DwAL5vIE0aaNAAGXUNpPLcKglw_N1w5R_A&r=1757084575&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 7F0F 35 B
463 B 39ms
30ms Image
image/gif 2620:116:800b:21:4cb8:1820:80ca:50f7
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFzOCfbrGRbX7Le45bq6mZA&google_cver=1&google_push=AaAOQGFIi4i0PGOlJQf1tmQ4TINb0vkHHEnNqOXq0MzG0fDoDRKbKBvbZKeqiUGpg9x0b75h3vYK5FK4mwfp9uJEERcLPbGaMZ9HGQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEMyp5ejsD5FKlJ3yfkVdmX8&google_cver=1&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS0...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA&google_cver=1&googl...

170 B
188 B

44ms
43ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA&google_cver=1&google_gid=CAESEMyp5ejsD5FKlJ3yfkVdmX8&google_hm=UTc0MjExMzI5NjEyOTUwMTg0MDI=

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 08 Jul 2023 14:34:57 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AaAOQGH48ClIcikZlk9aoLhGO29h_k99RWuOqp-mIkgrdqof0IAW1AdpNTixtd_QjbzS01oshAPRFhYtYLHWumnZDlW4zBYSuCUA&google_cver=1&google_gid=CAESEMyp5ejsD5FKlJ3yfkVdmX8&google_hm=UTc0MjExMzI5NjEyOTUwMTg0MDI=
Content-Type: text/html
Cache-Control: max-age=30902
Connection: keep-alive
Content-Length: 154

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESEF9A5fBh7T0PbSilHNYR7mo&google_cver=1&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w...
https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w2xv0zbcy6r48GTJJTg

170 B
188 B

41ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w2xv0zbcy6r48GTJJTg

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:56 GMT
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=extendtv&google_push=AaAOQGETxmO6dyRIorjGkX3kIbAuk-LB1lxlqE945yIvhGG1WTtb4PM8Z7osi-Fgr36ZTBKkzh6L5leD7I4w2xv0zbcy6r48GTJJTg
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 196
Expires: Tue, 29 May 1984 15:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG7n8W7fxE0VXJ2icQUlLZI&google_cver=1&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B452QYHA&google_hm=eS1pdmxwMXZaRTJwSDU3...

170 B
188 B

41ms
40ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B452QYHA&google_hm=eS1pdmxwMXZaRTJwSDU3ZF95c2loQ0tRWXNINVByeTlaSH5B

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 08 Jul 2023 14:34:56 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AaAOQGEg-eotNZ2CM51Wt8VMdZvvR-WhMfsD9aXWDzcwTkVjrzxXwS1-wdKMV0VfTuOU8hCeb9sEQ2CsFXqWJdthwOCL21B452QYHA&google_hm=eS1pdmxwMXZaRTJwSDU3ZF95c2loQ0tRWXNINVByeTlaSH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEJjExgtmhJ9PsrKrtSlo8a0&google_cver=1&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn5Jifiw2gECTqjlP5vZ1&google_hm=MTA1OTY3NTg4Mj...

170 B
188 B

42ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn5Jifiw2gECTqjlP5vZ1&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AaAOQGEXNEexdfFOzJgy6Qo4CscrVIMTedkcojgmeSS0FoD77C1acCrKOZZfu36sCL0aI6HN9MElT3Dfn5Jifiw2gECTqjlP5vZ1&google_hm=MTA1OTY3NTg4MjMwMDY4MDY2MTI
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_cver=1&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOk...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIDjSlrrBnRSM2Sg-kYY-Vw&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOk...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA&google_hm=OVB6ckl5RW11NnQ0S2...

170 B
188 B

43ms
42ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA&google_hm=OVB6ckl5RW11NnQ0S2Mxb3lxYlM=

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 08 Jul 2023 14:34:56 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AaAOQGHLtFQ-xRwnpLwX48Q5hhhf3F6bdkHGy5gQgN6upxvEDbYBRujNCiv76ZiL55RqlMeKyv8dkHTxt2mOkVK3dhuFEKjrYwB8tA&google_hm=OVB6ckl5RW11NnQ0S2Mxb3lxYlM=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7F0F
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAbi1E9bwe4SJekFqQ1HjEw&google_cver=1&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V-B...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiTXtYcDyGuZEAFexmGmkeiIzAtt6uBXg_g&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V...

170 B
188 B

42ms
41ms

Image
image/png

142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiTXtYcDyGuZEAFexmGmkeiIzAtt6uBXg_g&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V-Bn-B6M_iZcaq_rmxZ

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiTXtYcDyGuZEAFexmGmkeiIzAtt6uBXg_g&google_push=AaAOQGEp8g70HCYgR836OdW8TTtPFbEY-QMiMEpqY9O1mywmyCZ7w0POFZYV838dwdK4wYcIiGHlMA5o0V-Bn-B6M_iZcaq_rmxZ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7F0F 0
12 B 44ms
38ms Image
text/html 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JN5SOzrBIytzXpdF4Qazm_7T5z6Iq9bWJfgUET-41vXOo6bfFVGNWRSpQH8_2rXY_VDsuN

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.66 Staten Island, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 14:34:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 rtimp
g.bidbrain.app/ Frame 0D47 0
277 B 64ms
56ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bafdebe-1d9c-11ee-b70e-92bba817c364&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=load&p=ZKl0DwAL5vME0aaNAAGXUAeHICzW9NDpErXQ9w&r=1519372777&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
DATA 200
OK truncated
/ Frame 0D47 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db5b8b9a1f02339c166746c0929560523fdc17c4bc2f5819de3734fd73d0b4b9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 0D47 15 KB
16 KB 30ms
25ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 05:55:38 GMT
x-content-type-options: nosniff
age: 31158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 05:55:38 GMT

POST
H2 204 rtimp
g.bidbrain.app/ Frame 0D47 0
277 B 56ms
56ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bafdebe-1d9c-11ee-b70e-92bba817c364&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=vw_100&p=ZKl0DwAL5vME0aaNAAGXUAeHICzW9NDpErXQ9w&r=1519372777&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0D47 0
19 B 59ms
58ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CYd_OD3SpZPPNL43NxtYP0K6GoAuLv4iuZvG66fX_DsCNtwEQASAAYKECggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwHIAwKqBJoCT9DMllcVctw2GZ5KwOSnPEdzr60O_0Gnd17KUNFvJsCdKrioF4xiXdCOJNVxJr4UrDq7jkihgmvz2KUbL37dWtCBj-mgmxCyRBeAZf7G_REAagc_V6oa9NbrGcqVPRuhx8xL6K74LVbBAxanoZYiSBjp9whT7qFI3XJ-XlD0lXZT4steFM3Rp-9Lh8vDqfQ2CmBGz1fORK-BGsObg9lldU_HEN5A2G9CFGjOv6MoqVLp4KW2tvBxiiCSIIM6cYZfwaiCoCWnUnj5OnQy7kVZl7DiVQ4v_80itJbl8rL9VcegT0Miqrn_SjFYkNCVI3gtS1uBdYuTHM4yaXdo9bye5DppQHMTvg_c3z9DVVbf5_xWM0Cv2-VGD_Y0gAaGt9m6zo_U1g2gBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6gAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=oDuYT-a1vis&uach_m=[UACH]&cid=CAQSPABygQiDTOKMflpYx9dnEkWpu6QkmR8p8izSo9vygD8aKKncNXiiIEQhQFDyae4-4zS4ce0gXl734MrkjRgB&cbvp=2&vis=1

Requested by

Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 08 Jul 2023 14:34:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 rtimp
g.bidbrain.app/ Frame 0D47 0
277 B 63ms
60ms Image
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://g.bidbrain.app/rtimp?sid=9bafdebe-1d9c-11ee-b70e-92bba817c364&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=imp&p=ZKl0DwAL5vME0aaNAAGXUAeHICzW9NDpErXQ9w&im=3EdXRU8YyraYrxPwODSdVb-y6_LFLHQAcDjBQcOYo7e9tYmhI_XT2KONa_8NezxlLre1IyQTOO2-h6lG_mSY4ToqG0-rf0qFlTUFP5r4BtKSSMFUqA3tKIJ7k7SmdCLDaCJ0YU7BJvNT1J88EiP2xiGWopPLKCPj_qDWLXdauB333fbqpyhlUj3pDhg3eRXgQBhQb-loKzY5zAZcHG2U_yhPX7vX2LPKB4Atys6ZKP8hPC4DLxVvcMj5NFXU6WKZD5gCowdjjIA8qdxDK8SaHMx-twU9X-inZMbbrhq2KFfPizZEdOMReHOcbJdtLzqk5okWwCpzj9IBJsQvjIC_YoFuFMDBmxdc0efpE_e-WG9ohoPuweHx9Va5oSc71BCy9FLzT0mu_s0UdWSjP0e7Ow&cbvp=2
Requested by: Host: pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 204 ev
g.bidbrain.app/rt/ Frame A35E 0
0 55ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.717971572277583
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H2 204 rtimp
g.bidbrain.app/ Frame D9BE 0
128 B 56ms
54ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb312f5-1d9c-11ee-ad5c-267fd57a67d8&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=load&p=ZKl0DwAL5vEE0aaNAAGXUL1ST3pOHI_E4T56BA&r=1488408346&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H2 204 rtimp
g.bidbrain.app/ Frame D9BE 0
128 B 62ms
61ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb312f5-1d9c-11ee-ad5c-267fd57a67d8&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=vw_50&p=ZKl0DwAL5vEE0aaNAAGXUL1ST3pOHI_E4T56BA&r=1488408346&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame D9BE 0
0 53ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.19784025726183607
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame 0D47 0
0 52ms
52ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.9021349327747112
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame A35E 0
0 55ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.7319926851483223
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame D9BE 0
0 53ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.6135120115082273
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame 0D47 0
0 55ms
55ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.5087523883136555
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame A35E 0
0 54ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.1480978919546161
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H3 204 rtimp
g.bidbrain.app/ Frame D9BE 0
20 B 59ms
58ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb312f5-1d9c-11ee-ad5c-267fd57a67d8&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=ev_prf&p=ZKl0DwAL5vEE0aaNAAGXUL1ST3pOHI_E4T56BA&r=1488408346&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1&ps=%5B%22151.40%22%2C%2256.60%22%2C%2254.50%22%2C%2254.70%22%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 204 ev
g.bidbrain.app/rt/ Frame 0D47 0
0 53ms
53ms Fetch 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rt/ev?ka=0.43922139180206776
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H3 204 rtimp
g.bidbrain.app/ Frame A35E 0
20 B 56ms
56ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bb117b8-1d9c-11ee-8fe9-36ab3e1c8b08&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=ev_prf&p=ZKl0DwAL5vIE0aaNAAGXUNpPLcKglw_N1w5R_A&r=1757084575&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1&ps=%5B%2272.40%22%2C%2257.40%22%2C%2256.90%22%2C%2255.90%22%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

POST
H3 204 rtimp
g.bidbrain.app/ Frame 0D47 0
20 B 56ms
55ms Ping
text/plain 34.102.128.115
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.bidbrain.app/rtimp?sid=9bafdebe-1d9c-11ee-b70e-92bba817c364&d=pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&cr=ext_gen2_v10_start_sec7&gid=CAESEJCxNBdYsFGEkRNgCSDOzpo&a=ev_prf&p=ZKl0DwAL5vME0aaNAAGXUAeHICzW9NDpErXQ9w&r=1519372777&ow=1600&oh=1200&tzof=0&tz=Etc/Unknown&pxr=1&ps=%5B%2257.60%22%2C%2253.90%22%2C%2257.00%22%2C%2254.90%22%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230705/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.128.115 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 115.128.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:56 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,OPTIONS,POST,PUT
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Headers, Access-Control-Allow-Origin, Origin, Accept, X-Requested-With, X-Forwarded-For, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, Configs-Guid, X-Service-Auth, X-Client-Version
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D9BE 42 B
64 B 98ms
45ms Fetch
image/gif 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst24vPDQ_QpJqS603lFqoXBowXcDaKpQke0rYYMGPfSAUyA6V64NF4GVGeCsnZPF_AqVenOZdpSRNA9MlNYqF_vT9Tg&sig=Cg0ArKJSzI09mZ8M8_icEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=0,783,1000,1070,1164&tos=0,783,217,70,94&v=20230705&bin=7&avms=nio&bs=0,0&mc=0.75&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688826896343&rpt=203&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A35E 42 B
64 B 92ms
40ms Fetch
image/gif 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstFUONW4A7BICAB4EbopLcwefCpMM5fNE4ZQEVNVAbwPCfZWI559ndD9TdjZXd7Y5Q5qTBXyRmz1rRLn7i96EivGbIZ&sig=Cg0ArKJSzMGQ7OpgwH1nEAE&id=lidar2&mcvt=1003&p=0,0,600,200&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20230705&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688826896356&rpt=265&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0D47 42 B
64 B 97ms
45ms Fetch
image/gif 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsukMNJhAnQYHZ72P5O3qNqeLc6Rc9zAt0GlxSQyPh2_aqcYCLlujyIYv7O2tUXyPdm_4kw1m8IkYR2eBr766k9JDnbY&sig=Cg0ArKJSzPJD6oslZ0HXEAE&id=lidar2&mcvt=1000&p=0,0,600,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230705&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688826896359&rpt=316&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Jul 2023 14:34:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame EB75 0
127 B 30ms
29ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 08 Jul 2023 14:34:57 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

POST
H2 200 all
csm.us.criteo.net/ Frame EB75 0
127 B 31ms
30ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 08 Jul 2023 14:35:03 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESELKkcTNtAWrHMI57bPPGCng&google_cver=1&google_push=AaAOQGGimCeEFjBGg3kTh67icvDLAknEWPFd0gkkXqbfrc_f794z0C6C-f3kce5JpA5njUnJa9yxI4OfzmjF-60_El4-LHSqsakV_d0t

Verdicts & Comments Add Verdict or Comment

191 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

55 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bookmp3.ru/	1970-01-20 21:52:42	Name: __ddg1_ Value: vakUrsHwQDb1qHUhUzjT
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/	1969-12-31 23:59:59	Name: _csrf-frontend Value: 2f06b92aff63f6a39edf56290080c5196f8d1d732ea1356c29c2905918f54fa2a%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22%2B%16%5E%AA%13%F5%BB%98c%E8%FB%84%E4%A3%01%9A%A3%FF%80%92%13%84%E5h%CB%2Ch%BE%9A%96M%87%22%3B%7D
.yandex.ru/	1970-01-20 22:43:06	Name: i Value: 72MlLXrpdFadewFnINitDUWe7PjRqUFvaGKb5fG75pTXkOPG/wQ2YVdlu1L/QtD0WB6tB/5kSNaCE3iJCMZIFI/YK2E=
.yandex.ru/	1970-01-20 22:43:06	Name: yandexuid Value: 9970933641688826892
.betweendigital.com/	1970-01-20 21:52:42	Name: dc Value: was1
.betweendigital.com/	1970-01-20 21:52:42	Name: tuuid Value: e7695024-d2f6-53bd-a009-e93dc4a09d31
.betweendigital.com/	1970-01-20 21:52:42	Name: ut Value: ZKl0DAANBAgiQ_IyeZSj0qihgHu8YAOhOZdQ6Q==
.betweendigital.com/	1970-01-20 21:52:42	Name: ss Value: 1
.betweendigital.com/	1970-01-20 21:52:42	Name: unm Value: 1
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/	1969-12-31 23:59:59	Name: b Value: b
.bookmp3.ru/	1970-01-20 22:43:06	Name: _ga Value: GA1.2.42320924.1688826895
.bookmp3.ru/	1970-01-20 13:08:33	Name: _gid Value: GA1.2.1262657789.1688826896
.bookmp3.ru/	1970-01-20 13:07:06	Name: _gat Value: 1
.bookmp3.ru/	1970-01-20 22:28:42	Name: __gpi Value: UID=00000cade08fb365:T=1688826895:RT=1688826895:S=ALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ
.bookmp3.ru/	1970-01-20 22:28:42	Name: __gads Value: ID=a4deb0b64005b162-225b55d49de200ef:T=1688826895:RT=1688826895:S=ALNI_Maj6TDKqQ2Uc3MAteX6zqNO8_LZdg
.bookmp3.ru/	1970-01-20 22:43:06	Name: _ga_XR25G8TDFM Value: GS1.2.1688826895.1.0.1688826895.0.0.0
.yadro.ru/	1970-01-20 21:51:39	Name: FTID Value: 1agNGF00tg8b1agNGF003S-v
.hit.ua/	1970-01-20 22:43:06	Name: uid Value: 1142508217.1688826895.3399295960
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MStrA0NzY1MzW1NLcwsDA3MTcwNRDiM9QtiDApMDE38QowzisDAMqZatUlAAAA
.rfihub.com/	1970-01-20 22:28:42	Name: rud Value: H4sIAAAAAAAA_-MStrA0NzY1MzW1NLcwsDA3MTcwNRDiM9QtiDApMDE38QowzisDAMqZatUlAAAA
.yadro.ru/	1970-01-20 21:51:39	Name: VID Value: 0Z-Mw20QHhub1agNGG003T0G
.mookie1.com/	1970-01-20 22:35:54	Name: id Value: 10596758823006806612
.mookie1.com/	1970-01-20 22:35:54	Name: mdata Value: 1\|10596758823006806612\|1688826896065
.mookie1.com/	1970-01-20 22:35:54	Name: ov Value: f9ff0e2cf0ff51f57c6f9db4860329f9
.agkn.com/	1970-01-20 21:52:42	Name: ab Value: 0001%3Aq%2FIYBlTYcxV7%2F21AhG%2FFabrYcAeRhXaj
.agkn.com/	1970-01-20 21:52:42	Name: u Value: C\|0CEAsPDCQLDwwkAAAAAAAAQ13AQCAAQpAAAAAAA
.inmobi.com/	1970-01-20 15:16:42	Name: idsp_c Value: 98e0cbf3-8107-4a79-916a-38241e4b3ad7
.dotomi.com/	1970-01-20 13:07:06	Name: DotomiTest Value: 54b7a75cae7f21c6
.doubleclick.net/	1970-01-20 22:43:06	Name: IDE Value: AHWqTUlltETNn44mDdQB9FiPCurYWEWYjOg-mqEhsthohlhuzJ9l5cuYRMfMNFqX7xY
.bidbrain.app/	1970-01-20 22:43:06	Name: uid_cross Value: 9c23312e-1d9c-11ee-b0d5-4254e58cd3b6
.rfihub.com/	1970-01-20 22:28:42	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA129c8JyvI0D8lLLTAICnM19gkpTLFMcg3iNTSzsLAwMrOwNDM3Mn7FiMoHAKAI_5s9AAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA129c8JyvI0D8lLLTAICnM19gkpTLFMcgUAvErWSx4AAAA
.quantserve.com/	1970-01-20 15:16:42	Name: d Value: EAQBCQG1KYEA
.quantserve.com/	1970-01-20 22:37:21	Name: mc Value: 64a97410-bb8d3-18127-5bee0
.mathtag.com/	1970-01-20 22:33:02	Name: uuid Value: d32e64a9-7410-4800-a1f6-5c13bf3a6a22
.mathtag.com/	1970-01-20 13:50:18	Name: mt_mop Value: 4:1688826896
.travelaudience.com/	1970-01-20 22:38:47	Name: _tracker Value: %7B%22UUID%22%3A%228A35A053-4204-4469-AB32-7C17AB8D2756%22%7D
.ctnsnet.com/	1970-01-20 21:52:42	Name: cid_d46b42fb59604a8ab2dc778334414e7c Value: 1
.ctnsnet.com/	1970-01-20 21:52:42	Name: gid_CAESEPSputcLtwlMl181mtn_eR0 Value: 1
.mxptint.net/	1970-01-20 22:43:06	Name: mxpim Value: R33647_1057ECE00_42AB9C86.1.64A97410
.onetag-sys.com/	1970-01-20 22:36:53	Name: OTP Value: XEvw6kiogcoW_rxj67zrCW4aBXxidIlIl4Ab3BUS5Vw
.zemanta.com/	1970-01-20 21:52:42	Name: zuid Value: 9PzrIyEmu6t4Kc1oyqbS
.yahoo.com/	1970-01-20 21:53:04	Name: A3 Value: d=AQABBBB0qWQCEOndbyzjLrNk2Ux7hmyInRYFEgEBAQHFqmSzZAAAAAAA_eMAAA&S=AQAAAmnJmWbqgvCl4dSsl0YOKwY
.bidswitch.net/	1970-01-20 21:52:42	Name: tuuid Value: 479ed59c-6710-4c29-978f-044a26aa572a
.bidswitch.net/	1970-01-20 21:52:42	Name: c Value: 1688826896
.bidswitch.net/	1970-01-20 21:52:42	Name: tuuid_lu Value: 1688826896
.adsrvr.org/	1970-01-20 21:54:09	Name: TDID Value: 22287684-da13-414b-bcd4-6bcdabb1fbcc
.bidswitch.net/	1970-01-20 13:07:07	Name: google_push Value: AaAOQGE8PC3chYwRlfxQyqk7WVjHV2ZtWJEzm59WOh85kGIId_0IH4I520YOBhmSuN7ELwVE9EQPWuWRHhVWY6MD5FX5fjp6pRULZA
.adsrvr.org/	1970-01-20 21:54:09	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsIpJGQjNHy_zsQBRgFIAEoAjILCMykx7jn8v87EAU4AQ..
.owneriq.net/	1970-01-20 22:43:06	Name: si Value: Q7421132961295018402P
.owneriq.net/	1970-01-20 13:21:30	Name: p2 Value: gguuid
.owneriq.net/	1970-01-20 13:21:30	Name: gguuid Value: 1
.teads.tv/	1970-01-20 21:51:16	Name: tt_viewer Value: b3b42e7e-06d5-442f-86c4-19d8c6310d81
.bidbrain.app/	1970-01-20 13:07:14	Name: sid_cross Value: 9bafdebe-1d9c-11ee-b70e-92bba817c364
.tribalfusion.com/	1970-01-20 15:16:42	Name: ANON_ID Value: aYnseFyKalHobWm8ZbRyZcptAEQTq1gYHvEaQVQNoEsNpvUZa4rfpHtwcGsV0AZaYNNlqaZbi3UYOgFNt7wVATf7t

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/2/0/audiobook-vstan-i-umri.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/9/audiobook-mlada.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/8/audiobook-golova-professora-douehlja-7.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/7/audiobook-berezovyjj-sok.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/6/audiobook-o-ljubvi-6.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/5/audiobook-probuzhdenie-professora-berna.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/4/audiobook-aleksandra.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/3/audiobook-udivitelnye-prikljuchenija-egora-na-planete-dinozavrov.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/2/audiobook-krasavicy-3.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/1/audiobook-ostrov-mira-1.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/1/0/audiobook-blazhenny-krotkie-ibo-oni-nasledujut-zemlju.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/4/0/9/audiobook-dikijj-angel.jpg Message: Failed to load resource: the server responded with a status of 502 ()
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1688826895&rafmt=11&format=710x178&url=https%3A%2F%2Fpay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1688826895529&bpp=5&bdt=5641&idt=156&shv=r20230705&mjsv=m202306290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da4deb0b64005b162%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MYj74e8mdpuej505C16Qdy3EsiGMg&gpic=UID%3D00000cade08fb365%3AT%3D1688826895%3ART%3D1688826895%3AS%3DALNI_MZtfVdOGsV6oQ3ydUD9r73fgLNQFQ&correlator=1753909160374&frm=20&pv=2&ga_vid=42320924.1688826895&ga_sid=1688826895&ga_hid=121071666&ga_fc=1&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1689&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31075757%2C44788441%2C44796200%2C21065725&oid=2&pvsid=876136022517407&tmod=1089671422&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=PqvZpHvlRa&p=https%3A//pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=176 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2229d7ee49047daddff3c2876f8d945f.safeframe.googlesyndication.com
a.rfihub.com
a.tribalfusion.com
ad.mail.ru
ads.betweendigital.com
ads.travelaudience.com
ads.us.criteo.com
adservice.google.com
aep.mxptint.net
an.yandex.ru
b1sync.zemanta.com
beacon.walmart.com
c.hit.ua
cat.va.us.criteo.com
cm.g.doubleclick.net
cms.quantserve.com
counter.yadro.ru
csm.us.criteo.net
d.agkn.com
dclk-match.dotomi.com
dis.criteo.com
fonts.googleapis.com
fonts.gstatic.com
g.bidbrain.app
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
imageproxy.us.criteo.net
ius.ctnsnet.com
match.adsrvr.org
matchid.adfox.yandex.ru
mc.yandex.ru
mweb.ck.inmobi.com
odr.mookie1.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
pr-bh.ybp.yahoo.com
px.owneriq.net
rtb.adentifi.com
rtb.va.us.criteo.com
s.tribalfusion.com
securepubads.g.doubleclick.net
static.criteo.net
sync.extend.tv
sync.mathtag.com
sync.teads.tv
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
xp4stm90bvzr.frontroute.org
yandex.ru
yastatic.net
googlecm.hit.gemius.pl
104.65.247.96
142.250.64.66
199.38.167.130
20.114.74.38
20.85.134.6
213.180.193.90
216.200.232.249
23.197.21.93
2600:1f18:4e9:5a01:8254:be27:a710:e85f
2600:9000:2511:da00:19:fc2c:a140:93a1
2606:4700:3038::6815:e9df
2606:4700::6812:18ad
2606:ae80:1451:18::1720
2607:f8b0:4006:80e::2002
2607:f8b0:4006:80e::200e
2607:f8b0:4006:817::2001
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81c::200a
2607:f8b0:4006:820::2003
2607:f8b0:4006:821::2002
2607:f8b0:4006:821::2008
2607:f8b0:4006:823::2002
2607:f8b0:4006:824::2002
2620:100:a001::16
2620:100:a001::24
2620:100:a001::3
2620:100:a001::4
2620:100:a001::9
2620:116:800b:21:4cb8:1820:80ca:50f7
2a00:1148:db00::17
2a02:6b8:20::215
2a02:6b8::16b
2a02:6b8::1:119
2a02:6b8:a::a
34.102.128.115
35.186.193.173
35.190.0.66
35.190.90.30
35.211.178.172
38.98.69.175
44.206.49.18
45.147.197.153
51.222.239.230
52.223.40.198
54.224.64.87
64.202.112.159
74.119.119.147
74.119.119.150
77.88.55.60
88.212.202.52
89.184.81.35
96.46.183.20
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
12d8aae0cf51d039bfbef1c8f7ec828851423f05c8f9e5d290b2c2e15cd9a8a6
1718fde9aa3ddf3d77b0f2ae944f5d676d3223cfb88eda07b9b7db0485c472d2
18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c
192253b6be78d4a1030337cae32f62341aecc2510252cad0a33d7ba52c9d54aa
1fd9d901d114f9f15d1ace30fc1da168ea215e26c8d08a3c9e8ba609088f25c7
264ced8b72302036751497f0c2521369597135c9c9b4228513cd3050cf0e4bc3
29a7c723356d24b87edf9b33b45d0783eb2c8a4c4639c054adbc2c8f759e48f2
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bf958c032ce083c26ae980ed92d0360c971e87c183d6bd988e770fc172786c7
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
329b369901f4024b8daf7b92d195085e6509a8d7f74f3ebfdee7dad5d1c20093
32ec44401c24a4a2e559d925d0f1296451a9e28ddeaa297fee2157e8e04c1af4
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
3be3f024c46ff93eb55bb00f599911ef69c7957b19c8c3df9aca743259f35ae3
3d678f40df758f6400bd08adba790bd7084bfb71e276e9486665c5c1dd1fe204
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47a37cabd33f930dd28119e3ba60cca269770f1b2a774a52bad0a75d8076cd8a
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
507ec1ad6a9f25b2a4a1a2c314345a3a3d06abaa06c268ca3ea4f18c7560939e
536e34c7565c4714671ae6719af2c802921c8b21ccb05d87e4ffe3fa7ce9de17
5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
692a83221617b74acc8198b565bbdfa0365248f5df89578d6115382cc9508260
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
7320a8ba176680fddc0ae5c2df009477bd3f38b889a226f90b806eed4e20e72e
761d7adb1425097064e27e45fdf3965ba9954c5cdbfcd463873ad19994d7a9c1
7718a27fe3203dbe115ffe7fb1253ccd4f84cb6ac2c9c56a5c84186c8e912ec8
78ca6c9893f38b97721f9ca4e70fae4a53f1307392793b1ddd6fa3e1a3c7f6ff
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
8bbb94eaf2cf5da2373af7967daf1641f574ce1951c9e0ef5847b134b206708d
8deb7a7a15c7125927a0c8a8d56a5a96b2bb1573111d5d0bd1527e2eb9f4a5ec
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
96074263b0587e003f4ad803f27e39f93ac2a578511a9edbe0514b8705c909c0
96f7c3008354c54c1f51a896fc93ef08cddd0a3b6bf778295b6ef7204011373d
98181e4ff67a4268ecf4a330a696d0290b3ec58f5eb8ad26085f0f0fa87a0835
98d34a13bb45044273edb9133e3584a4396cf5f00017c95ccf3aa06187f49582
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9fca784c22034299fcdf5c3249c794d12a1c0db13b37f4fc6152dda09929cf0b
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a61735542ef93f832ab8321f9670a83ff11f58b5e122b2fb014199e32de05312
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a94755ecd90a113ceb5ffbb9a9834639bbf215711895074c4181eb309929ca25
ad25b0cf60d28e786d5b23c84960d3c3eace53fbdb60e7f88bf55b93e970ee9b
b15faaef64b833032bddedc75043c4786df2996b60e33467bdfa93775ee3a9cd
b201bd33880b35f05bd7e086eb6cb7e31f00b7dd5a5b1e72859b2b3c0bd7c375
b9db30db84c353b393ebed43c0803e40d62453ec010584b9449a28f0348cd01b
ba25de6782659210e549b88fbdc017f9363ac1ee1ee7631b87f44724a0f10d76
bc4540a14193a6537e0c03127bbf19848e6226bd437f2550d18f1f385c55eccb
c02d05ebc793000b84ba256eae55afdf3d265f946a51b61205b5621f43587113
c78393c6b017e4cc22d2f1f3c60f1134f6f68604026c9c076abb99c7f669530d
c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724
d076633408bf78e086b9125a46176d2fdeaf3a5d5b52bb9b3a9d562cea646006
d1eab251474ea81fd84ae5c0d4996f5f7774e0d717ee27184cdc456c18124025
d45975c8e3cceb32474b06a1125992532ae8cf0302f1a2a266460389e9acdde4
db0d17ee9c24794dc313d2588c0c19bccccb2f7439a0dcb6be8cc985df84baf3
db5b8b9a1f02339c166746c0929560523fdc17c4bc2f5819de3734fd73d0b4b9
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0c8101118f37916c887f89ad75c682464d9b6c7e685d04de2b730628c38e9fe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4527eeacda0c51dfb7a0f339f7522a8f2169ed05dc94ac947b4a5616cd56f4c
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6cafba2d8fd7a8d76f356f7f298fc1cf743ca78f9f17f997e9000ba587cc748
e7c67bbf39cb31a203980714670e128242d6713e39e36e99a3f7cd26bd50b96e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f919c02713441d1502a5297ec6201783ecf8070a47d5df866a78ca2fb83bc865

pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro 45.147.197.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

180 Requests

85 %HTTPS

51 %IPv6

42 Domains

56 Subdomains

37 IPs

5 Countries

1830 kBTransfer

5501 kBSize

55 Cookies

11 Outgoing links

Redirected requests

180 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pay.pay.sberbank.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro
45.147.197.153 Public Scan

Screenshot
Live screenshot

Full Image

180
Requests

85 %
HTTPS

51 %
IPv6

42
Domains

56
Subdomains

37
IPs

5
Countries

1830 kB
Transfer

5501 kB
Size

55
Cookies

180 HTTP transactions
4 data transactions