www.gismeteo.ua Open in urlscan Pro
2606:4700:3036::6815:5f92 Public Scan

bidder.am5.vip.prod.criteo.com

Software

nginx/1.17.9 /

Resource Hash

070edd0ab18ab6b3f4b981e9a81e6f192be28a176ac374ede1150f783f66f26b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:33:57 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fa972306-0c19-4a48-bd53-97099cbc4c20
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 361
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 arj Show response
setupad-d.openx.net/w/1.0/ 73 B
379 B 225ms
66ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://setupad-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.gismeteo.ua%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=16fa38d2-e6eb-4b05-82ef-30fe682c5c46%2C9d73836e-e68a-4bbe-aa60-6b1efbbfd50b%2Cc8b25087-1ad2-4d90-a705-0f45620e1261&nocache=1646829239404&pubcid=1f377a0e-5382-4326-bb34-412bcac08b07&schain=1.0%2C1!setupad.com%2C945%2C1%2C%2C%2C&aus=300x250%7C300x250%7C300x250&divIds=div-gpt-ad-60db0f16cd16186dc2971ad5%2Cdiv-gpt-ad-60db0f46cd16186dc2971ad6%2Cdiv-gpt-ad-60db0f6bcd16186dc2971ad7&auid=544016147%2C544016148%2C544016149
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.0 /
Resource Hash: b519fa851b9cd3cfb3a894d806bf8fcecdd4d4ce73f4121465efa8fb490ed649

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:57 GMT
content-encoding: gzip
server: OXGW/17.2.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.gismeteo.ua
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
330 B 287ms
101ms XHR
application/json 184.31.84.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=657865&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2225a33a9f344817%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.gismeteo.ua%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%224.40.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22setupad.com%22%2C%22sid%22%3A%22945%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222620f1c650fa1a9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22657865%22%2C%22sid%22%3A%22gismeteo.ua_300x250_mobile_top%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2227e7ae44c8cab88%22%2C%22ext%22%3A%7B%22siteID%22%3A%22657865%22%2C%22sid%22%3A%22gismeteo.ua_300x250_mobile_middle%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22289f97ad152dbc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22657865%22%2C%22sid%22%3A%22gismeteo.ua_300x250_mobile_bottom%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 950a7794810d00ff44d0f3936d25c4dea180a5f45d13122f80956c461864b60e

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:57 GMT
x-ak-initial-geo: CC:[GB], RC:[EN], CN:[EU], CIP:[82.199.130.41], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://www.gismeteo.ua
x-cs-client-geo: 27
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 36
x-ak-client-geo: 27
expires: Wed, 09 Mar 2022 12:33:57 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 321ms
97ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13606&site_id=148974&zone_id=1100368&size_id=15&rp_schain=1.0,1!setupad.com,945,1,,,&eid_pubcid.org=1f377a0e-5382-4326-bb34-412bcac08b07%5E1&rf=https%3A%2F%2Fwww.gismeteo.ua%2F&tk_flint=pbjs_lite_v4.40.0&x_source.tid=16fa38d2-e6eb-4b05-82ef-30fe682c5c46&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.347266609237048
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: db7ceee2d1b69272bd03ea056564e2d82d44d3af71c7906925987055b11281e1

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 376ms
152ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13606&site_id=148974&zone_id=2028892&size_id=15&rp_schain=1.0,1!setupad.com,945,1,,,&eid_pubcid.org=1f377a0e-5382-4326-bb34-412bcac08b07%5E1&rf=https%3A%2F%2Fwww.gismeteo.ua%2F&tk_flint=pbjs_lite_v4.40.0&x_source.tid=9d73836e-e68a-4bbe-aa60-6b1efbbfd50b&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.40282602293359604
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: a2ff209b7f2ab135307ef2ffb4eb324c8c908278baa4e85362ed49ee1c4944f4

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 315ms
87ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13606&site_id=148974&zone_id=2028898&size_id=15&rp_schain=1.0,1!setupad.com,945,1,,,&eid_pubcid.org=1f377a0e-5382-4326-bb34-412bcac08b07%5E1&rf=https%3A%2F%2Fwww.gismeteo.ua%2F&tk_flint=pbjs_lite_v4.40.0&x_source.tid=c8b25087-1ad2-4d90-a705-0f45620e1261&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8802044236451927
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: fdf9d96c5e24fd8006ab6fb243e6dae27ed7f346362bc3d773f3181487de1f54

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK prebid.1.1.aspx Show response
inv-nets.admixer.net/ 42 B
505 B 223ms
57ms XHR
text/javascript 146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL

https://inv-nets.admixer.net/prebid.1.1.aspx?data={%22imps%22:[{%22bidder%22:%22admixer1%22,%22params%22:{%22zone%22:%22297cc2c6-5a33-409d-93a3-75048331509e%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f16cd16186dc2971ad5%22,%22transactionId%22:%2216fa38d2-e6eb-4b05-82ef-30fe682c5c46%22,%22sizes%22:[[300,250]],%22bidId%22:%2234599310fa59e09%22,%22bidderRequestId%22:%22331092c382515bd%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}}],%22referrer%22:%22https%3A%2F%2Fwww.gismeteo.ua%2F%22}

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

c979ffd70003be58ccc574778b78d9303e8b5b3494a6cdeb01449d65a5a815e6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Keep-Alive: timeout=25
Content-Length: 42
X-Xss-Protection: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
116 B 247ms
82ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.gismeteo.ua
date: Wed, 09 Mar 2022 12:33:55 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK prebid.1.1.aspx Show response
inv-nets.admixer.net/ 42 B
505 B 222ms
58ms XHR
text/javascript 146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL

https://inv-nets.admixer.net/prebid.1.1.aspx?data={%22imps%22:[{%22bidder%22:%22admixer2%22,%22params%22:{%22zone%22:%22e17e28f8-2791-4c99-bab8-842c674097d2%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f16cd16186dc2971ad5%22,%22transactionId%22:%2216fa38d2-e6eb-4b05-82ef-30fe682c5c46%22,%22sizes%22:[[300,250]],%22bidId%22:%22402f19756a6fa57%22,%22bidderRequestId%22:%2239d1fc41d4a843c%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}}],%22referrer%22:%22https%3A%2F%2Fwww.gismeteo.ua%2F%22}

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

c979ffd70003be58ccc574778b78d9303e8b5b3494a6cdeb01449d65a5a815e6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Keep-Alive: timeout=25
Content-Length: 42
X-Xss-Protection: 0

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 4 KB
1006 B 756ms
609ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 92c1946c7701fbcdf7cd41aca7ea08f09ecdaa2f2cef335c8200c8caacd2f997

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Mar 2022 12:33:57 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Length: 719

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 622 B
947 B 427ms
142ms XHR
application/json 148.251.121.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 148.251.121.152 Braunlage, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: egon
Software: /
Resource Hash: 7e23783bd696876152fca41df8d6ad5f2b31682de4da9279823d9992226294c1

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:57 GMT
x-prebid: pbs-go/unknown
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 622
expires: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 0
337 B 215ms
51ms XHR
application/json 185.86.139.95
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.95 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:56 GMT
vary: Origin
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 0
337 B 215ms
52ms XHR
application/json 185.86.139.95
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.95 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:55 GMT
vary: Origin
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 0
337 B 216ms
52ms XHR
application/json 185.86.139.95
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.95 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:56 GMT
vary: Origin
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
216 B 206ms
55ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.40.0&cb=98531800249

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 09 Mar 2022 12:33:56 GMT
server: Finatra
vary: Origin
access-control-allow-origin: https://www.gismeteo.ua
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *

POST
H2 200 adjson Show response
ads.betweendigital.com/ 2 B
911 B 351ms
95ms XHR
application/json 188.42.29.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=prebid
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.42.29.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

GET
H2 200 / Show response
adx.adform.net/adx/ 15 B
488 B 277ms
103ms XHR
application/json 37.157.4.23
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?rp=4&bWlkPTEwMTQ3NjEmdHJhbnNhY3Rpb25JZD0xNmZhMzhkMi1lNmViLTRiMDUtODJlZi0zMGZlNjgyYzVjNDY%3D&bWlkPTEwMTQ3NjMmdHJhbnNhY3Rpb25JZD05ZDczODM2ZS1lNjhhLTRiYmUtYWE2MC02YjFlZmJiZmQ1MGI%3D&bWlkPTEwMTQ3NjUmdHJhbnNhY3Rpb25JZD1jOGIyNTA4Ny0xYWQyLTRkOTAtYTcwNS0wZjQ1NjIwZTEyNjE%3D&pt=gross&stid=d0f9d8a2-c360-4ce8-890e-f8739f234869&fd=1&eids=eyJwdWJjaWQub3JnIjp7IjFmMzc3YTBlLTUzODItNDMyNi1iYjM0LTQxMmJjYWMwOGIwNyI6WzFdfX0%3D

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.23 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

631bc9fa39ddcdd4008398e649671ba79db3cc7c1725d7b8cd9823ec243f0a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:57 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://www.gismeteo.ua
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

GET
H/1.1 200
OK prebid.1.1.aspx Show response
inv-nets.admixer.net/ 10 KB
10 KB 221ms
64ms XHR
text/javascript 146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL

https://inv-nets.admixer.net/prebid.1.1.aspx?data={%22imps%22:[{%22bidder%22:%22admixer%22,%22params%22:{%22zone%22:%22dd16669f-0d54-4af7-a578-730839d53b18%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f16cd16186dc2971ad5%22,%22transactionId%22:%2216fa38d2-e6eb-4b05-82ef-30fe682c5c46%22,%22sizes%22:[[300,250]],%22bidId%22:%2266c2906be520a3b%22,%22bidderRequestId%22:%2265fe5741bef2f92%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}},{%22bidder%22:%22admixer%22,%22params%22:{%22zone%22:%22b7ad374c-16b4-40c2-9143-18fbd5bd4845%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f46cd16186dc2971ad6%22,%22transactionId%22:%229d73836e-e68a-4bbe-aa60-6b1efbbfd50b%22,%22sizes%22:[[300,250]],%22bidId%22:%22673d5c160336441%22,%22bidderRequestId%22:%2265fe5741bef2f92%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}},{%22bidder%22:%22admixer%22,%22params%22:{%22zone%22:%220ca4fc7d-6d6b-4ab6-b261-97acd5b30495%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f6bcd16186dc2971ad7%22,%22transactionId%22:%22c8b25087-1ad2-4d90-a705-0f45620e1261%22,%22sizes%22:[[300,250]],%22bidId%22:%2268984170cf1ae58%22,%22bidderRequestId%22:%2265fe5741bef2f92%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}}],%22referrer%22:%22https%3A%2F%2Fwww.gismeteo.ua%2F%22}

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

c9984abb0d484da16d581a1aa28a1ccb0dd9fd6aeb6e0457dd1487af879a8e04

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Keep-Alive: timeout=25
Content-Length: 10055
X-Xss-Protection: 0

GET
H/1.1 200
OK prebid.1.1.aspx Show response
inv-nets.admixer.net/ 42 B
505 B 215ms
59ms XHR
text/javascript 146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to

Full URL

https://inv-nets.admixer.net/prebid.1.1.aspx?data={%22imps%22:[{%22bidder%22:%22go2net%22,%22params%22:{%22zone%22:%22dee0cdc4-0634-4d9e-95b3-10502961f443%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f16cd16186dc2971ad5%22,%22transactionId%22:%2216fa38d2-e6eb-4b05-82ef-30fe682c5c46%22,%22sizes%22:[[300,250]],%22bidId%22:%22706377432320b23%22,%22bidderRequestId%22:%22696aa6139f764ff%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}},{%22bidder%22:%22go2net%22,%22params%22:{%22zone%22:%22f9831b3b-af2a-4bc5-a2af-4ea2df634134%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f46cd16186dc2971ad6%22,%22transactionId%22:%229d73836e-e68a-4bbe-aa60-6b1efbbfd50b%22,%22sizes%22:[[300,250]],%22bidId%22:%2271e90e91c1bf8b1%22,%22bidderRequestId%22:%22696aa6139f764ff%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}},{%22bidder%22:%22go2net%22,%22params%22:{%22zone%22:%2257d8d21c-2647-4bb6-955d-50fb7126cc45%22},%22userId%22:{%22pubcid%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22},%22userIdAsEids%22:[{%22source%22:%22pubcid.org%22,%22uids%22:[{%22id%22:%221f377a0e-5382-4326-bb34-412bcac08b07%22,%22atype%22:1}]}],%22mediaTypes%22:{%22banner%22:{%22sizes%22:[[300,250]]}},%22adUnitCode%22:%22div-gpt-ad-60db0f6bcd16186dc2971ad7%22,%22transactionId%22:%22c8b25087-1ad2-4d90-a705-0f45620e1261%22,%22sizes%22:[[300,250]],%22bidId%22:%2272ad7f204e0d6f5%22,%22bidderRequestId%22:%22696aa6139f764ff%22,%22auctionId%22:%22d0f9d8a2-c360-4ce8-890e-f8739f234869%22,%22src%22:%22client%22,%22bidRequestsCount%22:1,%22bidderRequestsCount%22:1,%22bidderWinsCount%22:0,%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22setupad.com%22,%22sid%22:%22945%22,%22hp%22:1}]}}],%22referrer%22:%22https%3A%2F%2Fwww.gismeteo.ua%2F%22}

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

c979ffd70003be58ccc574778b78d9303e8b5b3494a6cdeb01449d65a5a815e6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Mar 2022 12:33:57 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Keep-Alive: timeout=25
Content-Length: 42
X-Xss-Protection: 0

POST
H2 200 bid Show response
a4p.adpartner.pro/hb/ 659 B
467 B 660ms
480ms XHR
application/json 137.74.6.209
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://a4p.adpartner.pro/hb/bid?tag=6587,6587,6587&sizes=300x250,300x250,300x250&referer=https%3A%2F%2Fwww.gismeteo.ua%2F
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.74.6.209 Warsaw, Poland, ASN16276 (OVH, FR),
Reverse DNS: app-ngx-pl-02.adpartner.pro
Software: nginx /
Resource Hash: 46467a838493eda29b90408888c56a26ea7d530d94b78ed940397e16baf8cf78

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.gismeteo.ua
date: Wed, 09 Mar 2022 12:33:57 GMT
cache-control: no-store no-transform
access-control-allow-credentials: true
server: nginx
content-encoding: br
content-type: application/json

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
177 B 169ms
50ms XHR
text/plain 185.184.8.65
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-65.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.gismeteo.ua
date: Wed, 09 Mar 2022 12:33:57 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
311 B 58ms
58ms XHR
text/plain 18.64.107.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.gismeteo.ua&pubid=fb12f96a-c574-4c9c-aae0-d4c14e79bb3f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.107.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-107-176.txl50.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 11:13:03 GMT
via: 1.1 6d74947505437c57fd215b170c6b3d90.cloudfront.net (CloudFront)
server: Server
age: 4854
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.gismeteo.ua
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: TXL50-P4
x-amz-cf-id: yH4PPAteZ407H-B4sQB3ZXyMvXi68J1JVcqKPEsVyHUxgNAOerTQQg==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
492 B 110ms
109ms XHR
text/javascript 18.64.107.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.gismeteo.ua%2F&pid=XOM4YZlABOtVu&cb=0&ws=1600x1200&v=7.73.0&t=900&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-60db0f16cd16186dc2971ad5%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21802255954%2Fgismeteo.ua_300x250_mobile_top%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-60db0f46cd16186dc2971ad6%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21802255954%2Fgismeteo.ua_300x250_mobile_middle%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-60db0f6bcd16186dc2971ad7%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21802255954%2Fgismeteo.ua_300x250_mobile_bottom%22%7D%5D&pubid=fb12f96a-c574-4c9c-aae0-d4c14e79bb3f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.64.107.176 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-64-107-176.txl50.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:57 GMT
via: 1.1 6d74947505437c57fd215b170c6b3d90.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: TXL50-P4
x-amz-rid: F1Z59X94KHVKS4HFXTW1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.gismeteo.ua
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: O6yg3Pchip_ilBx5BjsYcl0jCwTYFHUyTa5qGlG_QNYcZZHmt_SmXA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 174ms
59ms XHR
application/javascript 18.64.107.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.107.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-107-176.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-amz-version-id: SUwxoOFVf.oGi397tNuwFzfmo0lFzuJd
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 54311
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 02 Mar 2022 02:09:50 GMT
server: AmazonS3
date: Tue, 08 Mar 2022 21:28:47 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 d58f8ae27ab00bbbe1dc072976204492.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: TXL50-P4
x-amz-cf-id: pQi-6PtApKMvf8_a14G975AYCBKs6NJsFyxkAEz6BezYhauA5wFwwQ==

POST
H3 200 collect
www.google-analytics.com/ 35 B
55 B 61ms
61ms Ping
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://www.gismeteo.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 289ms
58ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 936
date: Wed, 09 Mar 2022 12:33:56 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 0D69 0
18 B 121ms
59ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.gismeteo.ua
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.gismeteo.ua
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=0
date: Wed, 09 Mar 2022 12:33:57 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 222ms
63ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.gismeteo.ua

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:33:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 200ms
62ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.gismeteo.ua

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:33:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 275 KB
110 KB 1608ms
1545ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1234184617316301&correlator=1946445908154755&eid=31064905%2C31065294%2C31065588%2C31061690&output=ldjh&gdfp_req=1&vrg=2022030701&ptt=17&impl=fifs&sc=1&sfv=1-0-38&ecs=20220309&iu_parts=21802255954%2Cgismeteo.ua_300x250_mobile_top%2Cgismeteo.ua_300x250_mobile_middle%2Cgismeteo.ua_300x250_mobile_bottom&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x250%7C1x1%2C300x250%7C1x1%2C300x250&fsapi=false&prev_scp=amznbid%3D2%26amznp%3D2%26hb_size%3D300x250%26stpd_pb%3D0.01%26hb_adid%3D819753bea105df8%26stpd_bidder%3Dadmixer%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=g_temp%3D10-15%26g_lang%3Dru%26g_page%3Dindex%26g_city%3D744%26g_country%3D35%26g_region%3D753%26g_weather%3Dcloud%26hb_rf%3D0&cookie_enabled=1&abxe=1&dt=1646829240224&lmt=1646829240&dlt=1646829238571&idt=743&biw=1600&bih=1200&oid=2&adxs=650%2C650%2C650&adys=303%2C1115%2C1834&ucis=1%7C2%7C3&adks=2508741518%2C486039185%2C673715409&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.gismeteo.ua%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1580x250%7C1580x250%7C1580x250&msz=1580x0%7C1580x0%7C1580x0&fws=4%2C4%2C4&ohw=1580%2C1580%2C1580&ga_vid=639854593.1646829239&ga_sid=1646829240&ga_hid=1838658071&ga_fc=true&btvi=0%7C0%7C1&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

52c81ec2e4cf26470083ca0fa3acbf56942893c0fa2b1898deb160e9f6c44e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112418
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.gismeteo.ua
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 131ms
69ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022030701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f6dd765c5313ceaddbf92119fe685393ae1bd9e6a96ab016a411119171f539e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:33:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10384
x-xss-protection: 0

GET
H2 200 container.html Show response
0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9EF2 6 KB
4 KB 207ms
62ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 09 Mar 2022 12:33:57 GMT
expires: Thu, 09 Mar 2023 12:33:57 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 400ms
58ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8d8a9c4b3954d44aa586c80eb8963694553bca477e95be61a9f19f1e8b0195fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:58 GMT
content-encoding: gzip
last-modified: Fri, 25 Feb 2022 21:31:17 GMT
server: nginx
etag: W/"62194aa5-18342"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 10 Mar 2022 12:33:58 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 221ms
67ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Mar 2022 12:33:58 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8804 13 KB
5 KB 119ms
54ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Mar 2022 11:48:32 GMT
expires: Thu, 09 Mar 2023 11:48:32 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 2726
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F937 783 B
1 KB 187ms
62ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

25f69778b3690172836a0a01a2346d48454f6ff23a92d050904f978f5a2bb054

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1rh7zVP+prY6w2FBSOKH/w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 09 Mar 2022 12:33:58 GMT
date: Wed, 09 Mar 2022 12:33:58 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-1rh7zVP+prY6w2FBSOKH/w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js Show response
pagead2.googlesyndication.com/bg/ Frame 8804 35 KB
13 KB 116ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c299cd7441c413e1fe1d6906628f36bdc1142e35fb5907ce8fefa36213db2dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 10:58:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92139
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13712
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 10:58:19 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 64FF 13 KB
5 KB 56ms
56ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.gismeteo.ua

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

f408ea8d108fb46b0ec7612b384c10211e19f6a21592b34a042751697f4249cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1130
date: Wed, 09 Mar 2022 12:33:58 GMT
content-length: 5145
strict-transport-security: max-age=31536000; preload;

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 228ms
115ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8d8a9c4b3954d44aa586c80eb8963694553bca477e95be61a9f19f1e8b0195fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:58 GMT
content-encoding: gzip
last-modified: Fri, 25 Feb 2022 21:31:17 GMT
server: nginx
etag: W/"62194aa5-18342"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 10 Mar 2022 12:33:58 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F937 0
0 124ms
102ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022030701&jk=1234184617316301&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H2

200

sid Show response
mug.criteo.com/ Frame 64FF
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=gismeteo.ua&sn=ChromeSyncframe&so=3&topUrl=www.gismeteo.ua&bundle=eEsbql9FQmxiMEhSc2k3WE91MmtmTjYzJTJGeVhxbjJpM2pmbkwlMkZ6dHRDU0x6Y05xYTdy...
https://mug.criteo.com/sid?cpp=HAFUTXxwc2JXY1MyQjFGamd0Nzg2N1dBL0pzVjlyTUoyZGh6V1RmZjRTNmNzTTBSejdUTm9lRmdSYTdub1FVeXYyWkVJYVBUVGdxOVFOYThpc2ZqSDNnS3Q3Qm5TaUJjMUs0bU4weGdEczNJSDA0WEtqZHNKNytSQU05VU...

433 B
633 B

61ms
61ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=HAFUTXxwc2JXY1MyQjFGamd0Nzg2N1dBL0pzVjlyTUoyZGh6V1RmZjRTNmNzTTBSejdUTm9lRmdSYTdub1FVeXYyWkVJYVBUVGdxOVFOYThpc2ZqSDNnS3Q3Qm5TaUJjMUs0bU4weGdEczNJSDA0WEtqZHNKNytSQU05VUZ1MHVEaWJsOXpBdEdtTHo2QkNjR0hjU214L1J6cFdrRmc2d0oxSTU2UEpXeVNWNHc0ZjRia1FQbUFFWTFQelJIWDhVeFM0TGJOTDk0QmswSEp1WHVuaUVIbzdPaGN5TVY4NmFWVVF4SEl1TWUrdVBIQkFqSTNvRSsvS1N1UXpzWmVkU3ZVYVpzd2lrUnpvL0wvQys4NnR2blNUNlQrQT09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

6ef1187bb3aac63f8e07686a82dff7562da444e5807dadfe5e6827d7a183f7dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:58 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3454
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:58 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=HAFUTXxwc2JXY1MyQjFGamd0Nzg2N1dBL0pzVjlyTUoyZGh6V1RmZjRTNmNzTTBSejdUTm9lRmdSYTdub1FVeXYyWkVJYVBUVGdxOVFOYThpc2ZqSDNnS3Q3Qm5TaUJjMUs0bU4weGdEczNJSDA0WEtqZHNKNytSQU05VUZ1MHVEaWJsOXpBdEdtTHo2QkNjR0hjU214L1J6cFdrRmc2d0oxSTU2UEpXeVNWNHc0ZjRia1FQbUFFWTFQelJIWDhVeFM0TGJOTDk0QmswSEp1WHVuaUVIbzdPaGN5TVY4NmFWVVF4SEl1TWUrdVBIQkFqSTNvRSsvS1N1UXpzWmVkU3ZVYVpzd2lrUnpvL0wvQys4NnR2blNUNlQrQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1513
content-length: 541
expires: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8804 0
9 B 54ms
54ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?SFCBlg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 91ms
90ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022030701&jk=1234184617316301&bg=!tbaltvLNAAb7UztL-1M7ACkAdvg8WpBPM7o4f-iCGGb7J2QI4KBe62hB6Gd0WtTWBjMpkJwoDjb5UgIAAAB0UgAAAAJoAQeZApQOzogEGJd2L5UdajpCrsaewOLhSojXlOK9ydmjVndnJMitgXxfTK65Xb86aNYm4jMVceBtra9rRDU45Y_GwLfTRAlVzz0xKnGOTZrwCHIB3gcdbOjlC67L85FqjcKmFKEyM4h32iZjskR4rxBYyZFFfz3Ru9RTSU4fEqnvSB_eCXCRbDYzfRt2d0RgT_pQTEmdELtrB6HWsHtedB84Fx2YigqHswSWgKEfD20Zs6rIGvMOTEec0dyO9NwwZI6EPOWj6P9zPFWMXf7KjH9rR2K8Vpu-oYuZOJDpekewWWlHRBgRr-8RQnA4ZX8cx5yjAzXCYG6u-VijHzCEvLUCHAldi4sNC93tCF2YYg-e6b39djHjn3AnXxEmypfdyjexBQOCU-T8h1p2z3cf-9ET4VQCyy38g8CwqbDLxK49X7xe8EGZwUdh_guqt9ah85R3y_5zhYg2oz7HB-RiUiSHWiuSjeiOKwIvnbj7Wrbnwq7qcsGvDWFFtUAo5HZrxwbh8ubciPDgtoStqBi9_0iHGtQtj3d2EUhP5OjzdtofCxWXUBrqI3T_zg9xal7-DED2GKQz9RyrYGEXqGLtmENYL_MlUKCmjc5C1Hy77VZhOknPDz2u-TkZPlob9wl3v1UrfDvbti43YD75ph86XoBlD9JHeUkcVWiW3nf7gjFfhJXgN4GGrjsbt3oou5HFiHOQTEwlSoTRVotddgxWx0_br3JoLkXocuGRLDLQDjO9hkdzWaq157QiA2paDFGSYywyJD5Wlwr34iVoTF7hgGYVPDR3ojZFjM_TEUsVoTMg8QdAZqt7O8rjyOmA9vIffgweeVKJBe_ZcwaftBctkOqG7BeS8k6ttDsg_W0uLi3C82O4hUk97iU

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 57F7 6 KB
3 KB 122ms
60ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Mar 2022 12:33:57 GMT
expires: Thu, 09 Mar 2023 12:33:57 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D540 6 KB
3 KB 114ms
57ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Mar 2022 12:33:57 GMT
expires: Thu, 09 Mar 2023 12:33:57 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/022202072236000/ Frame 0254 220 KB
60 KB 265ms
126ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9c141103b57e547274799df03069c30320e8cb3ec4facad8e6fe7f658f985fb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 372980
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61570
x-xss-protection: 0
server: sffe
date: Sat, 05 Mar 2022 04:57:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "55d07b8fd23efb21"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 05 Mar 2023 04:57:39 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/022202072236000/v0/ Frame 0254 16 KB
7 KB 194ms
56ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

372ddb86deaa3e11e5a4b1eec16924bcd6e6232bc8bab79338426b2faff7e7dd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 372980
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5708
x-xss-protection: 0
server: sffe
date: Sat, 05 Mar 2022 04:57:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4c9170e21c83610c"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 05 Mar 2023 04:57:39 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/022202072236000/v0/ Frame 0254 96 KB
29 KB 322ms
184ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af42f8a986eefec222a68474cc9c9591028b07b082157631d810ecbbf4a652fe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 372980
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29623
x-xss-protection: 0
server: sffe
date: Sat, 05 Mar 2022 04:57:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f660f99fdfd5d6c6"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 05 Mar 2023 04:57:39 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/022202072236000/v0/ Frame 0254 74 KB
17 KB 201ms
64ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb965f3699518d8395cfb70d083643955fc2933fe9b4f969c3dc7ea4aedea90

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 269108
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17272
x-xss-protection: 0
server: sffe
date: Sun, 06 Mar 2022 09:48:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8236b39f432ecf96"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 06 Mar 2023 09:48:51 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/022202072236000/v0/ Frame 0254 5 KB
2 KB 200ms
62ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3ef00ccf0d1329768a9546012c96ecb5ac031695b0418da9ae3297979ad60bb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 372981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1844
x-xss-protection: 0
server: sffe
date: Sat, 05 Mar 2022 04:57:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b0f41eb8e6d0a727"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 05 Mar 2023 04:57:38 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/022202072236000/v0/ Frame 0254 42 KB
13 KB 248ms
110ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022202072236000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js?cb=31065588

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

93b1f78578f169d4f472ecda3c79d72e81fa9e199bdb979d13139f5ddbe5a06d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 372980
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13623
x-xss-protection: 0
server: sffe
date: Sat, 05 Mar 2022 04:57:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "14164defe327400f"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 05 Mar 2023 04:57:39 GMT

GET
DATA 200
OK truncated
/ Frame 0254 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c57ca03d2f36e9663d3b3ad74025891122ad890bd6510af220d4c8d18f386ac3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ru.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 0254 3 KB
3 KB 58ms
57ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ru.png

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fed2d61088cba54be39b2069add7103160e31f07c950c0e2e7706d6d6dc9ebf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 18:06:10 GMT
x-content-type-options: nosniff
server: cafe
age: 66469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 6726277462267614359
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3041
x-xss-protection: 0
expires: Wed, 09 Mar 2022 18:06:10 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 0254 344 B
368 B 129ms
128ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 16:59:05 GMT
x-content-type-options: nosniff
server: cafe
age: 70494
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 6766994032117382215
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Wed, 09 Mar 2022 16:59:05 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0254 0
0 131ms
65ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQM5ymhARvyVPWmDitUKMUZZ_oqIBIAv2GENxFbo1cVNgVLJjYWciO-hk70zpyP-FxjsDuRinOd6M07kDZdfk6Gc7MalA
Requested by: Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H2 200 B26136620.308725970;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2905832133;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/ Frame 0254 42 B
762 B 225ms
89ms Image
image/gif 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2905832133;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 0254 0
0 98ms
97ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIjW0tZ4oYqP1MsHq3wOM2baABqjKht9o-9ivxdMPv-EeEAEgj8G1BmCVovGBkAegAb_nu8QDyAEJqQImacesD1CyPuACAKgDAcgDCKoE5gFP0MZKQUSFhPSpXKvy7d3ilbKc2wsTB2QjhgOHQaHWKxUfQOTST_1_9mlJ9zxM9M2MD0TnYYIEgDp2BwZEmQuh53Kttg-scOGOezDfvHQ2Hi8zU66Yo_ZtR9kLru354tEN-0OREBjWuVyeCkbC3NA4SGgM9P92kvmtgSs5k2PIwsXIjyPXZGMIZy6lHLkA2nbAVVXm0wvEijt8IA9w9vZRQMKAYLRDqad2YOmbDRtVpjhaJ92ZJxyXL4eQ1cvwzPz8hb02uffZwEqVbEXNvyp1v-2-CCHU-DqCGFq46M1HuRAetGioSMAElbPvprAD4AQBiAWm6sLVLpIFBAgEGAGSBQQIBRgEoAYu2AYCgAfAiZUfqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQnN8coAiH7acEsAgC0ggJCIjhgBAQARgdgAoByAsB2BMNghQRGg93d3cuZ2lzbWV0ZW8udWGIFALQFQGAFwGyFx4KHAgAEhRwdWItMDUxMTgyMjA4NzUxODE3MBiXpHA&sigh=30UVw6l-45Y&uach_m=[UACH]&template_id=419
Requested by: Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 0254 87 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0260337b1c60724525eb6e2521576dd57705213a8fb95a9fa63bd767feb3e4da

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1D48 624 B
558 B 187ms
66ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLan3wEQh__jARiglLrDATAB&v=APEucNURBATV7P80w2rAnSMsZh_R9b8-ujm3df_SLX5-EHY-FFXDUXh_5tXfGSrNOKZYbxMVEa-CN6lXjD3nv8l_tWSfC2vrwtI0dJ49Mb-Z0mF8E8t6OmA0l1bmtDmiYw2xPb6OeizBrFQXp9MBux5rlqwnh_C94j6Hzt4eayZpcIvlW4ttv1A

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Mar 2022 12:33:59 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Mar 2022 12:33:59 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D540 76 KB
32 KB 244ms
124ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnVIdPPPLBXJKtfm_xTozo9D4IhAq9ncLGdUvXBhYPJb0vY0eXOb9FMNaHVWpsy1Z2Dyybf86z5R-6R5Vg1vbEkSrU4_YNetw3c-0ozBjqF7nj_iP7GIt570_IVRpUTD2ttAyzCbxAT0MDlKDnHeuNNj3WaA&dbm_d=AKAmf-CSv0HBbpjHsb0RCGxxAfWEEsCHe-1B-wmYSHUqG1UBq57nQRwyHiydZcs0qRJUSOQVVpy0CbRs8bLCYomPWAmSIAzV7rqHTgmz1GZ2qQhTY9zxfJ6ytRagNmFvEtnA4oucesjkqepkojNtLxXpqO5stKZcEyZcyXpYntXbAPCMFYlJeAw7RRuLelY9ERJvCZHZu5CmchKna4ohRcsz9w1t0Op0W8f-DT9OhgENDMvMkoxvz5I2Lv17UyEar0k4xr42vVkaONXA4LCfGb8Dg9GBLqjV7MMEKTD5G72iB2w46hGumDBb9ycOsiL1J00Y19pQrsj4y8QREbngRzebsnul482xNKtHJOWfveOlCJXC8Vslsdg7VxyZ-MIQjZqq-QM4RCWPEGuOvNwC8oN9qBbZp9MwuEBInMgdSO6K1Rfp-OufGWWc2-Cq1tDsHM2eBKhIJfa9-f7TvUPc52Yd4Te9LQwNRF0hy4TWPaM_cPpemG1pfFKy3MeT-stg243YZcHIUx3g2EbNWMh8Tz1f3aRUzfx8QhMcUfAqvm5udzdDMZ8FfQ_apKt9iUIp9Xg-PNO0xOrgCp_TbbA9AId_pGu3C43k0RWtGNm53b7qGk3_MD4g0D3fH93LyCfJ0PiUSIaY1dXi5cb-t1dWWYBY98aj_KZZINW11T-_K8DM9CxQPMDjZNHiOYQrwG9ADhVC39KHbYfnwhDJbXPRLRFEHHiY4t8bNXHSWuq77mgl6gwlMjs___2GUvWSPYZuJIOfeeeeuJqrLgBeUZnpXXJqQ1diJUGuR2JVZo31CZeLYg5PY15zQdPe6JJq5z7fGRIpxmWNcXKwGQt_V5a32pRr2UHPPcFId3IBCE5tJ-QPcKkI8q11n5a0XXxdvaWJak4Whn_OeSyzGCuDUav2f7BQfHsSGJsU2fFog8LY0IPxFKfYZWgQqCPbN5wsS_pX9hw0eUHol0VFF7fvt0ZkS9lSm91y5waCvXZaSY8e_KNeeLtCfTWema1q0Vev7PhQmCBipJSXBlwkfVakZggQwDHG_cF8q4lmr2_YsiTJjq0p0hnjieZ8Eqt85wEp94oMigIMFNjA-gxmcH0Xmpmi26IRdbu4RBoLF0iEEyktU27mpiqH3b419iWtNXaLk74enbPSSMkrcFM3v2alMRRs_eiT3WGOLOyufG4MJgUFUiKtaMYkbrwRfmOUBN6HPebJ66UH_NKwz8fSzv5TY42fgIhuqE3_loKx-Qtnam8SYxC9OCZ3tI4ESkAOp5kxwmnEhY0shcpSsAzvKCJFUIAOvffVKlGa8jlLA5q9pPLJB94wV-g9CjLqhiWgjfWfglQQPYR1jwm1HZNQOMVX6XrKI-w4e7gNy3ZHBEIG6xxW4C7-J9RTBNlI-Ail-4IT7EpzQAWrT-e904R-xBm5DQCb7Hg9S51DhU8Wp0pjIW1PlHPGlJvqwN0k-49JZwRN8BcQ_lnNJ8DqFCXppOmaxZR1A74uh7q42-h_iUKNjFQwdtgCZSwythyxcjYKk62SiZI3l5LQjyLcvBHJz2884fl_js6YLTi6UHHP2i4FSpU7du7a5rahgds-_Ap-8MENg55yScNVZPs5EYGlxqd24DBccjhFT5PIIwjy8ceOpoqOHXMw6Fv5rvRdELf4LLkBCw3STDIa3Hf6f3vUozEUV2m9InmK0Rv9JkO3MT5WgsAKmvHtlz5Kvo0_WWHkMlwHvFN0Oxf6u9acI8eSMHf2btPnZVehRQScCzoq_sNNq22kuxh5u2T5i-IU8M98qbG7gK8TewnNiKLgflz1-5p4dwGftBj1NEMnkqy1yJV3i973EP9a6SluQ7tleuqQZ6ieB7tyAjGDsqw38-rNeUpRqaEInqcX-MHG-baXfwJ7nzqLVayIi6YoCiY9X-w421oT0fjhsFAR1NgimEAN90GWS5qqzoxe5fhavBjFSlMqQrJeHNb7LiuInhKoOCTzxBgSZebh9HkZLnfXRyirbkbiVp6LkUvyQIFR6ul55QjY8iApuIQMf_mPTOCR-msDXr3nomkNvWCDNvFx1xvkJJoOLT7nanq0bLbEG0sVFFI_bnuEaVoyPuzPlbvEA0TIkxilGiC80cS6AXZXTl4NvFMzAXhFFAd1W1bgZO1VoqDUIdVQywP4Zo3txynmZyOXbCDY6NdjX8Hg9tY8vfj1PJlPfBaTbw1DE-LGlYISu7XXrFKsb71GfqN1qeQ9_3OSwtLiHr2VwmyRo6qhFRtxdq6GwUdQ8HGeG7NMy6i7JY1FFw4XsSIsw0zsnTNlhGqJ24vq-QBNefbAsMqt-r5rUi2xe7hbHYoxSpMjga2clhk2qgDDDX9Xo6WbOHqG9H7iGqNiba_2vAtf_qeyLXBybfScuKCCahhLngCDrvpGM0pdZi47OOoMzc8DIykuCx5VJUbeejNuj7N9EfwBC71snWyPb2vE-DhY-fo-hF4mzbiilBnlaeQK-ovx_kYWpJp8sSj1w0kSKELR2usSoR_Kc2EZuiRw1-oTqAfIhW9ss6WTP99CH9OQlYboe07xSCJDqxoZeXoaitmatDaWcpSB45n8yJFzxHGbqdWYlpj0s-xRFE7pC25v7wmYNOZ1EO3ZGcY_td8Id97Fu6JwnK41qMN46ETbSTdWDNTlJNAj0kg6tAiETlLpvRu4YvDcvtXV6W9uzges_zWfdbfa9EmEi4HhhGShulbgBtTvv0skT5G9u4pmpGUKdX5GudVZz9V9BgBCN1ngx869rXXINf04UEM5-zbaa44mMeXoQgtwOOkZvM9KPjNHXN4jd8moGiSohJVcURKQs4kTC6RB9y0dMOGK67niz95dZsT7iPY9XepwsEd04WrPQ_ssWORfWnRKaYISeDg3dJ4ImWaIiHAjCUTYSJO0SdKUDBjfosDGVes6qy6AcB-yf8y1LAPyJZtyA3oNUZzgAvHM__IEKAAheWQjl508hyuHYtL66zqG_jNz57xDlKQwW2P0zsb7sKrNFjIgIZ_uMJdvkQtjJd2nqxUC7XOXFzsuMK5dumGueiZXIQJiUiQCc1269Wd5tywtbh3v32HZcbEyqzwkVtcjU1-YXmSJ2RyAOCvRegHCJD48JP5EtV0_I_8aGVSf4hvyQL2PnWfOmHrzdK8nwA61x_BsB9FD48pogzNSItKPD4iUYeh0hfGCQ9QAEQowvaJYwJnCWX4G49uSqjnmDHgJHCT5nMDPToZSAXev_80_g6oEio1fSVsbk7sToWjThuObl9fWAQyZfphgrPuR5Hf9Gz-oYTjEYjjo-WMDxgQme0_HcyDCzpn1Ab0KFcxY2nJKNigglQB-Bu6_MSp3qzalML6N6PzoOF5mBCZT6jmif0b4pyt1Hrmq-QlTRMA0DzTO4Ft6VMw9Lr2Dtj3sWbYyvpWr0NgNIJ8go_4_I-L_YIVkMR02zppZzkTZmPv16PMMJR4Ad8bH2yJp75uhTe18fychdgpIFqNWhD0rrTShCMtLbjF3R45M-922Wyx5-xHSgVd4u5NhBgSg2qrVVSduy6FwsH69kLLy1_D4kt6Q4Ft8gtdQJefyznbCO_zJXua5QANoiZ6c4_KM4ayr03OyL754aZc9X1GmjXc39xBLog&cid=CAASJ-RovyK6ucM1KxNeHbloRSdz_2ULR2Lvv4o6bUWSahfg8ro3mQEjBg&rfl=1%2Chttps%253A%252F%252Fwww.gismeteo.ua%252F%240

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89350662a66141fe8366fb516d515e81faf820ac5e1da55bae194129ba72ce99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32853
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D540 42 B
63 B 86ms
86ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CcTHaTm0zLDNYI5W4IXGxr-sL0ypVrskYhf8vffEt-mqw9uZeIq4KmcJMqCH8hI-kx_V7SHht5VS23ThHkYTWfTouNow2DHFwY2nmm0UoQ5JpGSd0

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/ Frame D540 2 KB
1 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 203
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:30:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D540 124 KB
38 KB 162ms
100ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d55a162ebc22d9db98873e0ecf0c76c634df66a6045ea1cab8a4d0b77c607985

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38802
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1646656195544221"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Mar 2022 12:33:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/ Frame D540 15 KB
6 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d054377044014c1069958d9c610330164f05edbf091b2be9b6be60dc4f043494

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6417
x-xss-protection: 0
server: cafe
etag: 10598556267281433416
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:31:33 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D540 0
0 71ms
65ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ5LP0SFTPG3OprClJxKoAa4F7wB7i71Vl9UMR6e37bBVmeSQQcg1okjdTrHGgO8eu_8pZ7fGsL8aJHU90BZs4CKMyPrQ
Requested by: Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CE35 624 B
976 B 182ms
65ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIT3ob0BMAE&v=APEucNUC-wr9wFDmRz0InDJfkxgPCHKrIFRw21zJMuJBIzQkfZuicQUTIu5FU5UbBQ24-mEv1UA72JosBkuVSSzI6qeplTPMaBvH3BN_68AK6uJ3eca_UZykbnQSSQHZ_ttgVaXzZ-oNeILFjVHOx-kcA-QJQC5qUBtYz28OuCoW-8XdtOxw3RY

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 09 Mar 2022 12:33:59 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 09 Mar 2022 12:33:59 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 57F7 85 KB
35 KB 258ms
142ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFrZx-BvlMvIvdCxvO0As0uVHUBRBMrMeGE83vo9mbl8lEcOoeG_lq4w49NTaU-rOwl_P252rHV7uSFOFSzts3nXqSz2H58ujLWS8k5w1GNw-917RVXsIhTdWTcJmAoY2uLPJib9ENRSAD-4HaKjavoAJo-w&dbm_d=AKAmf-Bd_pGH0HdjYEn7X_G1IRQBBXLJVwwjoKFMlJO0txh8nZt54Nfssg00tqJN_v_dMj6hz6Y1uSIPV6nwFfzDcRZJCqvMgR-aLC_36GbM04uuu2w-h3fm2HahhwD2LskfzuS7QDE9GAPXkT5th31Lo4kyq49RZst_zP7ABonmnKcqlpclH2qSMAkxp4YWtjYeJ-Us7Dmc-wvFRrzP1D1SM43bOPlL8YPRAMMOWjttGojsOu5h_e91WVCA68DqbPN4hAfoSN_Y8E7Kp7GWEDSxXypS-AFNOq2DOOdNTWhuZzd2YlQrg5-a4nzDwIn3SvP-5r_3xkij4bx26fKYAcZah9SqyZvU7BrsXYvFR7IQtVabTTWVAXhc7sXa8YMQp1qLggRCIezgyWHc4uaug4cMwDR0-tE2hOba9t7oedsIUwwg_FBfZXMcFcmIc_8R-1QTsSJoPZHyCIrzR7eQBCv6qpW6WukiqM_E6a2xWFuftjZGnMcgVi2l-ZJ_uqLdZ3RasZLzNlBeHwGwRcNw9JO5jjicORttgaO9ZaB3fyxKH-ZyaW2ONb4Gqv-etbegU3mSP9vAeNNeSDEi1r1uMvjZBq52T7Tl548CzenrDraGuqn2ORfIdnSBX9xxLfi0iTc5yGzimPR5zblKDunVDY0iOsAD9MfIUuYv8g_UgTDPY3vEsaddhW1Pv-uIGSTRX1dv5kT88clhS3SpUc8kwyMNyBxq5K2S7hsMF44xwWlUr_D6jYlMGx-wqsJY4WyZaGugODdn0tpN0wtI7ROimngMeqGV-0N4MvBrTquofVZDdOpONNxSRauDjRfsA-D86Sj2jgdDD4dbAoQCCKEsvcEhMOPSZdl0F8TBdKlYC_T72O42HYomatFBf22UmxwOx8Q1-1KjumMLbqeRkfborb6alE--BkRfIjjndjf89J_rMt_75euO5_7Uf_um3rTMj92AhHYorla56tksDGma-8DtFbJKDhEpUBKFy-MDQzPzmEj_27HxsukaDHMWAHYmlOcnT2Az8_HitQuSDQKxb6n5gop922jXOffuKKmESy57FHX8fQ4ib_BgfSQbwMWBYkUX9zG_JxWc4n4N1CeVYNR1_kJPRf9mnQ4w8RrnovhykxvVU0NIweWTtVMHvHzoWXFCGUZXtN4rjLiwy5vmnvt_zfibL5JS4CNqURWz6dqqh723XYTblR6gS6gcgO5VfQLUeGwt9lwVPlzhIeaQoIsR0cqCOEnr3fgUMgB9ipI1B2pG2NFH6AQ2oPYVdEdWHde8AsWG5NZMZBh5wO2aSLelty78FoZSp-0oBQBHou1Fx2vk2kFwSVS2GcYPHNpmkkHST22eyHKKlh3FqwnBNneeNi_rkPZolHnckmYg0SiDiVljKrnPyzqeocZAbAIkd3Q6A1DgAfTeqNslZ6zfvc8ti5PmToA5KnAsJuGhW9sJKtKJhIpxdI4W5r3Ei0QImFexmB5WssqLokMar00ntRnqyhaDiqkvfoKI5RKxKgoW2X5p0rDEk682mMvfcwTvOqp3tuQQPC3NkIDTPDAjKRuo2i6Xz8agksou4UA2farY0xMTVTxfSVLCwybr3QgDXHUZNkkptn5r2-3qeIymUanUprScDSknXvJyThKc2YTEzzRyAs30cmqzb3vDsoK5ndS0wL-83XYcBGF7cl5FZYoLOqrFIIP6Uaot5fADFTKB2WMbM451KfPL82FIxXYNHrpYpGBmnfDWEt3t3Bz6vsNLdfrMjg3wo7zibgfVptepEx1JI8bmB1WeqYD9uDqyBS-0neloFwopA0Xtr2NFQn6dyOAfR6aqIHDTWs1_65BxMcCKGl1or7vQ0kcgP24xZIejkI7To8q2mtJfYeuMf29ZwxooN6wlCWlFOK4oj8FItaQw7Z1q4z52s9gpXKPEwzd39aq80wfZ3AoRaRfoBo7q5DbENyaXA-FsOjQ3sF18n0_zmKc8qko0y7peekElZ-yOubDN3ADBD19nDB5zf-0PSppivVUAjQirqhECRKhqbNs5glNcdq3QbAsBIlJQvFDGlAGzOH9Eg5f8XaC1GLkfiwMJCWB2zyDRunqaSfJSg6jT1kbIv9s8zJ8vaUWHUWFv6GJp2ce1cLait__fJ6wTjXLQ9yQ1uOG4mBUKAhukAWMiM7OTdP6MQBNhE7zAL3FQmb4t3VtXr5tr58jQ3h5V5z9EXVgtsHTDzHCqT9cObEQFJH1Z2BD5jzxwzIOV5-5aWZ8s4EGfWe4cmHZPLt7vTbPsW6tmEUaf8fN2PKpWn1ww0Xk9Ql_ipBGI-ZBWoXxkKqi8paEW4T1vS8vtmx1mJJ2zHxga_i1e8rKwDH7mYLND4cBDgTiqDO0Sa9c5HhEhvy2dndi1OqHqMijAzy6Og5hZchKpYWlQmmMLiE20o0xael6J7E3exbBqgRmbm0C2Jp7NGU_itwR-1eDHpctSVssIJu2OFX9Rog5oqJDVSynq6sQXaFLGjlQbk1oxJGHJgqEye_BZRh7TR9WcMnKHW-g9InLTu4sLK1D6727ASuk8CWH2QIOLgV2zqi03NqM54DcH7IGsVo8d8FuZ_2n6cfFUBL4VcewdPAFDR-Gyuc8C9YPae5kB7MzZkJo8AGwo_O7qSvkupi6fP_cd21irS3jtEU47QwYVWW4Aw2aWb5hRjMYB8yVm3-zr9j9Hvo-FjfBY1jQmExa9iRQ5lJBSM_865Ibt_Ucu8hRl5iPT5_G3ovR7QDRhsqD7Z4DdbIl8OoIOVde-HMCtt7gVs1LD3F1mr-cDv7rLwwqOzfvN47xf5wxMV9H-hjVubGb8gqXy0Xy8WEry4ntAHApo6ODCnpUnJu-m8YuHFPeLOu2u5_lX6dBwgEhZ1cb3d5JMmfsvHby7POLBEQs5pEe6dJC0rqj7RKG-PkZJtyC-enebf68-ooSHciwEQDfWei94L7PIrq_c7HFulE9eNrgyOWt48ZEvaGR9PCb3QBpYiS_me-V8qsQfMYu6VZ4qNfQAC6tAAozIWZk76QGKH-wVkTvyl9L_YiNY1vj_WoMWyBl2fWa5MIsQfWuFBH2LH-rqwvLgS63NeD36JY2kc0eBin3epRUmO1W80FWfeWnDgk-2y6YzgHoMpHePwUHuCz02n012w-wt54hwi-txIr9wtgfHtL3qmKnhdcI3yRGidhOEMxI8olkz-yTIVPBc5F8TgBypxJUlw8v3DTgulQNnMl4GyIIRiH9yfY_Vi2JjBkR9EUA4px_VHZq9cVV5rJAf4Czneic_dLjjSsVnviywjEfuJG_aW7C_vCyb5rV5hsqNNplqG-qt0HSTKhyyo3UCR15gHoA0ktF4QOt-JLXCNd-z7FVk7kQHEhfBi2ou3JzpBlsH9Q8_-5uSw4YS-MOeNVdAcuAxtgU26BiaNzEC-fPl-eJwhYsr8VPCvEX1yFHoDN6RfygDsSi-AWmeE83FPjkzSq04S_cdTB6NsuxmBVaZ24dJqYa0M8MS-dSRcrNKxrg0rIkZPbGXpVA1gEwB-u-1BpU8OG8q4p4256JigUcQL8BuQx-oRIELeyBwkVjX-taCTpKGfxE&cid=CAASJ-Ro3feSHVlUChD7ezeI0wkN4ZXQ2dbOHsfy7HvKNarhJ4MXPMaPPA&rfl=1%2Chttps%253A%252F%252Fwww.gismeteo.ua%252F%240

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bcba907ae4a775083f13149c4848f03bc98889452c745b79b06a015a93bebce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35467
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57F7 42 B
63 B 87ms
86ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CX3ExVJDGHUiTMFHSNZeSGbC0B9HUMFgLsHxvpJM0y7xpTVCe35zWlO-mCjSH_rpLAi4Xr17s8oDfoRpO3Mv2ondjVuP5_5UJmnK6VXHGu2XmgIa8

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 57F7
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/907318/59567102/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
483 B

186ms
53ms

Image
image/gif

2600:9000:2240:c400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:2240:c400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Fri, 06 Aug 2021 16:14:35 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
age: 18562765
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: cKEORzjtO0qdq3-bVWyKAI7FJwrQD-SL-7KFLgfVKLy4C23Fv-VYjw==

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/ Frame 57F7 2 KB
1 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 203
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:30:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 57F7 124 KB
38 KB 133ms
75ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d55a162ebc22d9db98873e0ecf0c76c634df66a6045ea1cab8a4d0b77c607985

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38802
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1646656195544221"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Mar 2022 12:33:59 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/ Frame 57F7 15 KB
6 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220303/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d054377044014c1069958d9c610330164f05edbf091b2be9b6be60dc4f043494

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6417
x-xss-protection: 0
server: cafe
etag: 10598556267281433416
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:31:33 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 57F7 0
0 65ms
64ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSSZQSl_N4uUef-r1DODPWIKNlnz35JVDYZH_YjwNi6c0Lce6YgjellmocB3KHMKJ2p7HKurnOyCsWDEHo3EVvl-eOP-A
Requested by: Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CE35
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1

43 B
1013 B

100ms
89ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIT3ob0BMAE&v=APEucNUC-wr9wFDmRz0InDJfkxgPCHKrIFRw21zJMuJBIzQkfZuicQUTIu5FU5UbBQ24-mEv1UA72JosBkuVSSzI6qeplTPMaBvH3BN_68AK6uJ3eca_UZykbnQSSQHZ_ttgVaXzZ-oNeILFjVHOx-kcA-QJQC5qUBtYz28OuCoW-8XdtOxw3RY
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 09 Mar 2022 12:34:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CE35
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YiietwgANCenYGUKPabyDwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1

43 B
893 B

74ms
74ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIT3ob0BMAE&v=APEucNUC-wr9wFDmRz0InDJfkxgPCHKrIFRw21zJMuJBIzQkfZuicQUTIu5FU5UbBQ24-mEv1UA72JosBkuVSSzI6qeplTPMaBvH3BN_68AK6uJ3eca_UZykbnQSSQHZ_ttgVaXzZ-oNeILFjVHOx-kcA-QJQC5qUBtYz28OuCoW-8XdtOxw3RY
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame CE35
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1

43 B
1004 B

138ms
137ms

Image
image/gif

185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIT3ob0BMAE&v=APEucNUC-wr9wFDmRz0InDJfkxgPCHKrIFRw21zJMuJBIzQkfZuicQUTIu5FU5UbBQ24-mEv1UA72JosBkuVSSzI6qeplTPMaBvH3BN_68AK6uJ3eca_UZykbnQSSQHZ_ttgVaXzZ-oNeILFjVHOx-kcA-QJQC5qUBtYz28OuCoW-8XdtOxw3RY

Protocol

HTTP/1.1

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ec1ba8ee-cebd-47b0-82dd-d9e779bd67c3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CE35
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI2OTMzNDQ2MTMzOTU1OTg5NA%3D%3D

170 B
243 B

83ms
82ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI2OTMzNDQ2MTMzOTU1OTg5NA%3D%3D

Requested by

Protocol

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:33:59 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c65d9ff0-83b6-4b66-9c56-64f14889d4df
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjI2OTMzNDQ2MTMzOTU1OTg5NA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1D48
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1

43 B
1013 B

98ms
87ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLan3wEQh__jARiglLrDATAB&v=APEucNURBATV7P80w2rAnSMsZh_R9b8-ujm3df_SLX5-EHY-FFXDUXh_5tXfGSrNOKZYbxMVEa-CN6lXjD3nv8l_tWSfC2vrwtI0dJ49Mb-Z0mF8E8t6OmA0l1bmtDmiYw2xPb6OeizBrFQXp9MBux5rlqwnh_C94j6Hzt4eayZpcIvlW4ttv1A
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFSY69wNh75KYbqCCcge3E&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 09 Mar 2022 12:34:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1D48
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YiietwgANCenYGUKPabyEAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1

43 B
893 B

70ms
69ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLan3wEQh__jARiglLrDATAB&v=APEucNURBATV7P80w2rAnSMsZh_R9b8-ujm3df_SLX5-EHY-FFXDUXh_5tXfGSrNOKZYbxMVEa-CN6lXjD3nv8l_tWSfC2vrwtI0dJ49Mb-Z0mF8E8t6OmA0l1bmtDmiYw2xPb6OeizBrFQXp9MBux5rlqwnh_C94j6Hzt4eayZpcIvlW4ttv1A
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELbRmUa0UBu0qTcUgf9gEWU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 1D48
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1

43 B
1004 B

112ms
112ms

Image
image/gif

185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLan3wEQh__jARiglLrDATAB&v=APEucNURBATV7P80w2rAnSMsZh_R9b8-ujm3df_SLX5-EHY-FFXDUXh_5tXfGSrNOKZYbxMVEa-CN6lXjD3nv8l_tWSfC2vrwtI0dJ49Mb-Z0mF8E8t6OmA0l1bmtDmiYw2xPb6OeizBrFQXp9MBux5rlqwnh_C94j6Hzt4eayZpcIvlW4ttv1A

Protocol

HTTP/1.1

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e18ad58f-c224-434a-93ed-a9d0bcb47fb5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:33:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJH2U4EgvdIgCbpOokxYULs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D48
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5MjE0NzczOTUxNzQ0MzU4MQ%3D%3D

170 B
188 B

146ms
81ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5MjE0NzczOTUxNzQ0MzU4MQ%3D%3D

Requested by

Protocol

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 6fa2059d-36fc-4915-8d3e-e966b17391e5
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5MjE0NzczOTUxNzQ0MzU4MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
209 B 203ms
61ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Wed, 09 Mar 2022 12:33:59 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame D540 106 KB
38 KB 205ms
55ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
Origin: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 16:07:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73562
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 09 Mar 2022 16:07:58 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/elements/html/ Frame D540 8 KB
3 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnVIdPPPLBXJKtfm_xTozo9D4IhAq9ncLGdUvXBhYPJb0vY0eXOb9FMNaHVWpsy1Z2Dyybf86z5R-6R5Vg1vbEkSrU4_YNetw3c-0ozBjqF7nj_iP7GIt570_IVRpUTD2ttAyzCbxAT0MDlKDnHeuNNj3WaA&dbm_d=AKAmf-CSv0HBbpjHsb0RCGxxAfWEEsCHe-1B-wmYSHUqG1UBq57nQRwyHiydZcs0qRJUSOQVVpy0CbRs8bLCYomPWAmSIAzV7rqHTgmz1GZ2qQhTY9zxfJ6ytRagNmFvEtnA4oucesjkqepkojNtLxXpqO5stKZcEyZcyXpYntXbAPCMFYlJeAw7RRuLelY9ERJvCZHZu5CmchKna4ohRcsz9w1t0Op0W8f-DT9OhgENDMvMkoxvz5I2Lv17UyEar0k4xr42vVkaONXA4LCfGb8Dg9GBLqjV7MMEKTD5G72iB2w46hGumDBb9ycOsiL1J00Y19pQrsj4y8QREbngRzebsnul482xNKtHJOWfveOlCJXC8Vslsdg7VxyZ-MIQjZqq-QM4RCWPEGuOvNwC8oN9qBbZp9MwuEBInMgdSO6K1Rfp-OufGWWc2-Cq1tDsHM2eBKhIJfa9-f7TvUPc52Yd4Te9LQwNRF0hy4TWPaM_cPpemG1pfFKy3MeT-stg243YZcHIUx3g2EbNWMh8Tz1f3aRUzfx8QhMcUfAqvm5udzdDMZ8FfQ_apKt9iUIp9Xg-PNO0xOrgCp_TbbA9AId_pGu3C43k0RWtGNm53b7qGk3_MD4g0D3fH93LyCfJ0PiUSIaY1dXi5cb-t1dWWYBY98aj_KZZINW11T-_K8DM9CxQPMDjZNHiOYQrwG9ADhVC39KHbYfnwhDJbXPRLRFEHHiY4t8bNXHSWuq77mgl6gwlMjs___2GUvWSPYZuJIOfeeeeuJqrLgBeUZnpXXJqQ1diJUGuR2JVZo31CZeLYg5PY15zQdPe6JJq5z7fGRIpxmWNcXKwGQt_V5a32pRr2UHPPcFId3IBCE5tJ-QPcKkI8q11n5a0XXxdvaWJak4Whn_OeSyzGCuDUav2f7BQfHsSGJsU2fFog8LY0IPxFKfYZWgQqCPbN5wsS_pX9hw0eUHol0VFF7fvt0ZkS9lSm91y5waCvXZaSY8e_KNeeLtCfTWema1q0Vev7PhQmCBipJSXBlwkfVakZggQwDHG_cF8q4lmr2_YsiTJjq0p0hnjieZ8Eqt85wEp94oMigIMFNjA-gxmcH0Xmpmi26IRdbu4RBoLF0iEEyktU27mpiqH3b419iWtNXaLk74enbPSSMkrcFM3v2alMRRs_eiT3WGOLOyufG4MJgUFUiKtaMYkbrwRfmOUBN6HPebJ66UH_NKwz8fSzv5TY42fgIhuqE3_loKx-Qtnam8SYxC9OCZ3tI4ESkAOp5kxwmnEhY0shcpSsAzvKCJFUIAOvffVKlGa8jlLA5q9pPLJB94wV-g9CjLqhiWgjfWfglQQPYR1jwm1HZNQOMVX6XrKI-w4e7gNy3ZHBEIG6xxW4C7-J9RTBNlI-Ail-4IT7EpzQAWrT-e904R-xBm5DQCb7Hg9S51DhU8Wp0pjIW1PlHPGlJvqwN0k-49JZwRN8BcQ_lnNJ8DqFCXppOmaxZR1A74uh7q42-h_iUKNjFQwdtgCZSwythyxcjYKk62SiZI3l5LQjyLcvBHJz2884fl_js6YLTi6UHHP2i4FSpU7du7a5rahgds-_Ap-8MENg55yScNVZPs5EYGlxqd24DBccjhFT5PIIwjy8ceOpoqOHXMw6Fv5rvRdELf4LLkBCw3STDIa3Hf6f3vUozEUV2m9InmK0Rv9JkO3MT5WgsAKmvHtlz5Kvo0_WWHkMlwHvFN0Oxf6u9acI8eSMHf2btPnZVehRQScCzoq_sNNq22kuxh5u2T5i-IU8M98qbG7gK8TewnNiKLgflz1-5p4dwGftBj1NEMnkqy1yJV3i973EP9a6SluQ7tleuqQZ6ieB7tyAjGDsqw38-rNeUpRqaEInqcX-MHG-baXfwJ7nzqLVayIi6YoCiY9X-w421oT0fjhsFAR1NgimEAN90GWS5qqzoxe5fhavBjFSlMqQrJeHNb7LiuInhKoOCTzxBgSZebh9HkZLnfXRyirbkbiVp6LkUvyQIFR6ul55QjY8iApuIQMf_mPTOCR-msDXr3nomkNvWCDNvFx1xvkJJoOLT7nanq0bLbEG0sVFFI_bnuEaVoyPuzPlbvEA0TIkxilGiC80cS6AXZXTl4NvFMzAXhFFAd1W1bgZO1VoqDUIdVQywP4Zo3txynmZyOXbCDY6NdjX8Hg9tY8vfj1PJlPfBaTbw1DE-LGlYISu7XXrFKsb71GfqN1qeQ9_3OSwtLiHr2VwmyRo6qhFRtxdq6GwUdQ8HGeG7NMy6i7JY1FFw4XsSIsw0zsnTNlhGqJ24vq-QBNefbAsMqt-r5rUi2xe7hbHYoxSpMjga2clhk2qgDDDX9Xo6WbOHqG9H7iGqNiba_2vAtf_qeyLXBybfScuKCCahhLngCDrvpGM0pdZi47OOoMzc8DIykuCx5VJUbeejNuj7N9EfwBC71snWyPb2vE-DhY-fo-hF4mzbiilBnlaeQK-ovx_kYWpJp8sSj1w0kSKELR2usSoR_Kc2EZuiRw1-oTqAfIhW9ss6WTP99CH9OQlYboe07xSCJDqxoZeXoaitmatDaWcpSB45n8yJFzxHGbqdWYlpj0s-xRFE7pC25v7wmYNOZ1EO3ZGcY_td8Id97Fu6JwnK41qMN46ETbSTdWDNTlJNAj0kg6tAiETlLpvRu4YvDcvtXV6W9uzges_zWfdbfa9EmEi4HhhGShulbgBtTvv0skT5G9u4pmpGUKdX5GudVZz9V9BgBCN1ngx869rXXINf04UEM5-zbaa44mMeXoQgtwOOkZvM9KPjNHXN4jd8moGiSohJVcURKQs4kTC6RB9y0dMOGK67niz95dZsT7iPY9XepwsEd04WrPQ_ssWORfWnRKaYISeDg3dJ4ImWaIiHAjCUTYSJO0SdKUDBjfosDGVes6qy6AcB-yf8y1LAPyJZtyA3oNUZzgAvHM__IEKAAheWQjl508hyuHYtL66zqG_jNz57xDlKQwW2P0zsb7sKrNFjIgIZ_uMJdvkQtjJd2nqxUC7XOXFzsuMK5dumGueiZXIQJiUiQCc1269Wd5tywtbh3v32HZcbEyqzwkVtcjU1-YXmSJ2RyAOCvRegHCJD48JP5EtV0_I_8aGVSf4hvyQL2PnWfOmHrzdK8nwA61x_BsB9FD48pogzNSItKPD4iUYeh0hfGCQ9QAEQowvaJYwJnCWX4G49uSqjnmDHgJHCT5nMDPToZSAXev_80_g6oEio1fSVsbk7sToWjThuObl9fWAQyZfphgrPuR5Hf9Gz-oYTjEYjjo-WMDxgQme0_HcyDCzpn1Ab0KFcxY2nJKNigglQB-Bu6_MSp3qzalML6N6PzoOF5mBCZT6jmif0b4pyt1Hrmq-QlTRMA0DzTO4Ft6VMw9Lr2Dtj3sWbYyvpWr0NgNIJ8go_4_I-L_YIVkMR02zppZzkTZmPv16PMMJR4Ad8bH2yJp75uhTe18fychdgpIFqNWhD0rrTShCMtLbjF3R45M-922Wyx5-xHSgVd4u5NhBgSg2qrVVSduy6FwsH69kLLy1_D4kt6Q4Ft8gtdQJefyznbCO_zJXua5QANoiZ6c4_KM4ayr03OyL754aZc9X1GmjXc39xBLog&cid=CAASJ-RovyK6ucM1KxNeHbloRSdz_2ULR2Lvv4o6bUWSahfg8ro3mQEjBg&rfl=1%2Chttps%253A%252F%252Fwww.gismeteo.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 472
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:26:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/ Frame D540 25 KB
9 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5421be34bc9ac3564a6daa35c769d13876e5fa7c4a5ed4892e9e8c65d31c1e27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:29:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9662
x-xss-protection: 0
server: cafe
etag: 2172778821077356944
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:29:37 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 57F7 169 KB
59 KB 237ms
117ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
Origin: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 11:23:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4247
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Mar 2022 11:23:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/elements/html/ Frame 57F7 8 KB
3 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFrZx-BvlMvIvdCxvO0As0uVHUBRBMrMeGE83vo9mbl8lEcOoeG_lq4w49NTaU-rOwl_P252rHV7uSFOFSzts3nXqSz2H58ujLWS8k5w1GNw-917RVXsIhTdWTcJmAoY2uLPJib9ENRSAD-4HaKjavoAJo-w&dbm_d=AKAmf-Bd_pGH0HdjYEn7X_G1IRQBBXLJVwwjoKFMlJO0txh8nZt54Nfssg00tqJN_v_dMj6hz6Y1uSIPV6nwFfzDcRZJCqvMgR-aLC_36GbM04uuu2w-h3fm2HahhwD2LskfzuS7QDE9GAPXkT5th31Lo4kyq49RZst_zP7ABonmnKcqlpclH2qSMAkxp4YWtjYeJ-Us7Dmc-wvFRrzP1D1SM43bOPlL8YPRAMMOWjttGojsOu5h_e91WVCA68DqbPN4hAfoSN_Y8E7Kp7GWEDSxXypS-AFNOq2DOOdNTWhuZzd2YlQrg5-a4nzDwIn3SvP-5r_3xkij4bx26fKYAcZah9SqyZvU7BrsXYvFR7IQtVabTTWVAXhc7sXa8YMQp1qLggRCIezgyWHc4uaug4cMwDR0-tE2hOba9t7oedsIUwwg_FBfZXMcFcmIc_8R-1QTsSJoPZHyCIrzR7eQBCv6qpW6WukiqM_E6a2xWFuftjZGnMcgVi2l-ZJ_uqLdZ3RasZLzNlBeHwGwRcNw9JO5jjicORttgaO9ZaB3fyxKH-ZyaW2ONb4Gqv-etbegU3mSP9vAeNNeSDEi1r1uMvjZBq52T7Tl548CzenrDraGuqn2ORfIdnSBX9xxLfi0iTc5yGzimPR5zblKDunVDY0iOsAD9MfIUuYv8g_UgTDPY3vEsaddhW1Pv-uIGSTRX1dv5kT88clhS3SpUc8kwyMNyBxq5K2S7hsMF44xwWlUr_D6jYlMGx-wqsJY4WyZaGugODdn0tpN0wtI7ROimngMeqGV-0N4MvBrTquofVZDdOpONNxSRauDjRfsA-D86Sj2jgdDD4dbAoQCCKEsvcEhMOPSZdl0F8TBdKlYC_T72O42HYomatFBf22UmxwOx8Q1-1KjumMLbqeRkfborb6alE--BkRfIjjndjf89J_rMt_75euO5_7Uf_um3rTMj92AhHYorla56tksDGma-8DtFbJKDhEpUBKFy-MDQzPzmEj_27HxsukaDHMWAHYmlOcnT2Az8_HitQuSDQKxb6n5gop922jXOffuKKmESy57FHX8fQ4ib_BgfSQbwMWBYkUX9zG_JxWc4n4N1CeVYNR1_kJPRf9mnQ4w8RrnovhykxvVU0NIweWTtVMHvHzoWXFCGUZXtN4rjLiwy5vmnvt_zfibL5JS4CNqURWz6dqqh723XYTblR6gS6gcgO5VfQLUeGwt9lwVPlzhIeaQoIsR0cqCOEnr3fgUMgB9ipI1B2pG2NFH6AQ2oPYVdEdWHde8AsWG5NZMZBh5wO2aSLelty78FoZSp-0oBQBHou1Fx2vk2kFwSVS2GcYPHNpmkkHST22eyHKKlh3FqwnBNneeNi_rkPZolHnckmYg0SiDiVljKrnPyzqeocZAbAIkd3Q6A1DgAfTeqNslZ6zfvc8ti5PmToA5KnAsJuGhW9sJKtKJhIpxdI4W5r3Ei0QImFexmB5WssqLokMar00ntRnqyhaDiqkvfoKI5RKxKgoW2X5p0rDEk682mMvfcwTvOqp3tuQQPC3NkIDTPDAjKRuo2i6Xz8agksou4UA2farY0xMTVTxfSVLCwybr3QgDXHUZNkkptn5r2-3qeIymUanUprScDSknXvJyThKc2YTEzzRyAs30cmqzb3vDsoK5ndS0wL-83XYcBGF7cl5FZYoLOqrFIIP6Uaot5fADFTKB2WMbM451KfPL82FIxXYNHrpYpGBmnfDWEt3t3Bz6vsNLdfrMjg3wo7zibgfVptepEx1JI8bmB1WeqYD9uDqyBS-0neloFwopA0Xtr2NFQn6dyOAfR6aqIHDTWs1_65BxMcCKGl1or7vQ0kcgP24xZIejkI7To8q2mtJfYeuMf29ZwxooN6wlCWlFOK4oj8FItaQw7Z1q4z52s9gpXKPEwzd39aq80wfZ3AoRaRfoBo7q5DbENyaXA-FsOjQ3sF18n0_zmKc8qko0y7peekElZ-yOubDN3ADBD19nDB5zf-0PSppivVUAjQirqhECRKhqbNs5glNcdq3QbAsBIlJQvFDGlAGzOH9Eg5f8XaC1GLkfiwMJCWB2zyDRunqaSfJSg6jT1kbIv9s8zJ8vaUWHUWFv6GJp2ce1cLait__fJ6wTjXLQ9yQ1uOG4mBUKAhukAWMiM7OTdP6MQBNhE7zAL3FQmb4t3VtXr5tr58jQ3h5V5z9EXVgtsHTDzHCqT9cObEQFJH1Z2BD5jzxwzIOV5-5aWZ8s4EGfWe4cmHZPLt7vTbPsW6tmEUaf8fN2PKpWn1ww0Xk9Ql_ipBGI-ZBWoXxkKqi8paEW4T1vS8vtmx1mJJ2zHxga_i1e8rKwDH7mYLND4cBDgTiqDO0Sa9c5HhEhvy2dndi1OqHqMijAzy6Og5hZchKpYWlQmmMLiE20o0xael6J7E3exbBqgRmbm0C2Jp7NGU_itwR-1eDHpctSVssIJu2OFX9Rog5oqJDVSynq6sQXaFLGjlQbk1oxJGHJgqEye_BZRh7TR9WcMnKHW-g9InLTu4sLK1D6727ASuk8CWH2QIOLgV2zqi03NqM54DcH7IGsVo8d8FuZ_2n6cfFUBL4VcewdPAFDR-Gyuc8C9YPae5kB7MzZkJo8AGwo_O7qSvkupi6fP_cd21irS3jtEU47QwYVWW4Aw2aWb5hRjMYB8yVm3-zr9j9Hvo-FjfBY1jQmExa9iRQ5lJBSM_865Ibt_Ucu8hRl5iPT5_G3ovR7QDRhsqD7Z4DdbIl8OoIOVde-HMCtt7gVs1LD3F1mr-cDv7rLwwqOzfvN47xf5wxMV9H-hjVubGb8gqXy0Xy8WEry4ntAHApo6ODCnpUnJu-m8YuHFPeLOu2u5_lX6dBwgEhZ1cb3d5JMmfsvHby7POLBEQs5pEe6dJC0rqj7RKG-PkZJtyC-enebf68-ooSHciwEQDfWei94L7PIrq_c7HFulE9eNrgyOWt48ZEvaGR9PCb3QBpYiS_me-V8qsQfMYu6VZ4qNfQAC6tAAozIWZk76QGKH-wVkTvyl9L_YiNY1vj_WoMWyBl2fWa5MIsQfWuFBH2LH-rqwvLgS63NeD36JY2kc0eBin3epRUmO1W80FWfeWnDgk-2y6YzgHoMpHePwUHuCz02n012w-wt54hwi-txIr9wtgfHtL3qmKnhdcI3yRGidhOEMxI8olkz-yTIVPBc5F8TgBypxJUlw8v3DTgulQNnMl4GyIIRiH9yfY_Vi2JjBkR9EUA4px_VHZq9cVV5rJAf4Czneic_dLjjSsVnviywjEfuJG_aW7C_vCyb5rV5hsqNNplqG-qt0HSTKhyyo3UCR15gHoA0ktF4QOt-JLXCNd-z7FVk7kQHEhfBi2ou3JzpBlsH9Q8_-5uSw4YS-MOeNVdAcuAxtgU26BiaNzEC-fPl-eJwhYsr8VPCvEX1yFHoDN6RfygDsSi-AWmeE83FPjkzSq04S_cdTB6NsuxmBVaZ24dJqYa0M8MS-dSRcrNKxrg0rIkZPbGXpVA1gEwB-u-1BpU8OG8q4p4256JigUcQL8BuQx-oRIELeyBwkVjX-taCTpKGfxE&cid=CAASJ-Ro3feSHVlUChD7ezeI0wkN4ZXQ2dbOHsfy7HvKNarhJ4MXPMaPPA&rfl=1%2Chttps%253A%252F%252Fwww.gismeteo.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 472
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:26:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/ Frame 57F7 25 KB
9 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220303/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5421be34bc9ac3564a6daa35c769d13876e5fa7c4a5ed4892e9e8c65d31c1e27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:29:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9662
x-xss-protection: 0
server: cafe
etag: 2172778821077356944
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 23 Mar 2022 12:29:37 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D540 41 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Mon, 07 Mar 2022 16:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Mar 2023 16:08:04 GMT

GET
DATA 200
OK truncated
/ Frame D540 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a182d4e760168e17daf6e9b0bf8839f8710f420eb7ad7f8e79f97e111752782

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 57F7 41 KB
15 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Mon, 07 Mar 2022 16:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Mar 2023 16:08:04 GMT

GET
DATA 200
OK truncated
/ Frame 57F7 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 010d10c74805c1de3c596213d8eb3d3932c293f674df3f32087fbd8601074e3d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1131 22 KB
8 KB 54ms
54ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 07 Mar 2022 16:08:05 GMT
expires: Tue, 07 Mar 2023 16:08:05 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 159955
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F008 22 KB
8 KB 54ms
54ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 07 Mar 2022 16:08:05 GMT
expires: Tue, 07 Mar 2023 16:08:05 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 159955
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js Show response
pagead2.googlesyndication.com/bg/ Frame 1131 35 KB
13 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c299cd7441c413e1fe1d6906628f36bdc1142e35fb5907ce8fefa36213db2dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 10:58:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13712
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 10:58:19 GMT

GET
H3 200 wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js Show response
pagead2.googlesyndication.com/bg/ Frame F008 35 KB
13 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c299cd7441c413e1fe1d6906628f36bdc1142e35fb5907ce8fefa36213db2dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 10:58:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13712
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 10:58:19 GMT

GET
H3 200 DE_makeover_garden_2022_mid_funnel_balkon_300x250_html5_banner-637816440224682097-eafd3144-dede-4075-880f-d9e591f29371.html Show response
s0.2mdn.net/sadbundle/9507312078034042880/ Frame EF38 4 KB
1 KB 119ms
55ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9507312078034042880/DE_makeover_garden_2022_mid_funnel_balkon_300x250_html5_banner-637816440224682097-eafd3144-dede-4075-880f-d9e591f29371.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

814117b1df15bc99891299947e59efc01c944f08004e589339427b03c0353227

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1427
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Tue, 08 Mar 2022 22:06:25 GMT
expires: Wed, 08 Mar 2023 22:06:25 GMT
cache-control: public, max-age=31536000
age: 52055
last-modified: Mon, 28 Feb 2022 11:20:44 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D540 0
61 B 272ms
129ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssb70pcnOhm4ipJ5jh1FuwcWWps-1zrTGzu3FN1SaiYJdQBmyooykN81megxr0RmkBKSnN6C6UlJyoHiebticNQLt6X-tTemKAsyyVUJZotGs5AYUpSyfzacF66BeI89T6X0PmIIyMp4Xwe_JwM9zTp4vpYga_RvfY5-TaNyqFCDyadiRM-mfKBqdA5HikbDzqH9VX4j4poztcRqONRRx_n6XW5YMeS3PP45nbLXuJADcBXhRPkxYpQ2sdlBg4e_uozNdJV-9-18_qjmw55OQRS3jlFQz42GUQk8UlpcxPY0Ef96AF0EESWRrx1X3g0pnTMoneJJohKhfUyl4IBHCxDA7V6lQnwaZWksZZ9rDLPEPqSctR2-ZjTz0V5oVbgutzSAWMWlg_B0r1pyOgFh33LZ6xLllPJmQFmTvRl_FKzTr49IwjoEHUzfVPalyrLJCRo5FXBh6WlR0hCHwL8POslqiqO7J_S8vEBA9MboW5-oALL8JBjlKmVa7ucpzWNFQNVkmJNS9VvwU6--dyNLrtC9PSRfeCPCZPXChNTXGak774sYMwTO5jJUoNVxUeZgLYabUJyDtp2qXv5siui7eKYo0AK6kN8PeZFOHmb_tyg2MGI0zTZVXOQwtJh_PX3KrU53_inokLgOJa0ge-fPbq4cum5uK7OuPhymABdhZZRuTRyDGs3eeGBSS8R85lx1vM9DAh8cC2l07OMeqZ0uv6iVi5tNsEhHJkIQhsTdrTAQ4hdHfGEvyFjh623LbjHkOIGuR4Te6Hfr977xUMrqQt9Lm1QDl_RmABoMnFGqZfqhReiYiNKKL0GbtkOFswvKdTJX-UJ3P1k17paEbyLrLwoxHnjf2rYCRjjWtrjckLAOO53CPuyWF9UpOI-kg_sQ7XIxeCYDNJPoYBGtk3RJ-zu7g05m4UNBuzANdY4yoadrbAYrhPSFj9DWgrgCNwPg5PlSWug9kLIO7d3lF5zh7F9gEQepvPEuP63AOZCZUTltACf84wmGjJDvFQhOUffVSaAt10LDiI8eA1rVcDOGdm6RCkSx3UhQmrKZWUH4Yfwl46BMOdJC02RGUr72SwzZeXKcNcAMNQkeaQA9t59V2Mb7j7rcATwsoDoRIiR5SmXr6X7L-XS77G-6TUylw3fderup61XkQIdXESNIm503xEZM9csZgMiOH2cFlZSh3_9wQTEN3IKt0_XRrWcrF1fNdymR53nBCYIBWPEajMrCvOYq6FASS_MttLN6i8BqUf3W7Hq277_ZcFhlYxhA-4S&sai=AMfl-YQdxLT4THR-5WpUOmnHOP-_rRAkJpDDXzRAgI8bDSd_kvSf7WiMrBe4iFEmMsUf23GztkFOLWAAKV-lK5HY9ecEiYznn9xyLo8G7JEilThuiI9J-jPJINTvNMGgUhln-iXmPk0P7lwLcwtrOg_wy7SK9m0OIE0VhK7GkgBwsJqh4JjuZ1_SyZoD8m3ApstdpRzyPFiibz2IEBoqgv5Lt6vJM-ukk_s&sig=Cg0ArKJSzKfWIqx1sU-LEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=386&cbvp=1&cstd=374&cisv=r20220303.95445&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Mar 2022 12:34:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6657181183598343709/ Frame 6C5D 36 KB
6 KB 63ms
63ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6441798447ba251e1090a35dcee01ee8b3e9446325a4c058fabda6090a90a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
expires: Thu, 09 Mar 2023 12:34:00 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 05 May 2021 19:27:44 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 57F7 0
571 B 172ms
96ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssw9hFRhspGxBD45xcrg3YIBAFcxkkpdy5xPmhmJtXMJfewXEiRgR3cjv58paTIvGJC61UElCYULnGFIk9ejrfpZX-P-5e9vsjE5_UMLDzJSZRPN9YvVobLkxyboJtV2lfuIf6XUDpJEFo5QQOFohqMODax9efQW68bjO3FQi7MMngz6DM_zGKaSUyPFfsY2MIe30BIwW3FxxBrQd9Q9HTu2aYCFIMWF7u4YHG285jSXXsJw0-FlJ1p8L2dwqPPRifWz69FDfqbHqaDm-6CVK77id1NVZPcBW26bCBZwKx-ske9pjNKw308g1AJFHU8Ha28SwUbvNZ_EFneZQJEufvDR0k1IrzbFU6nezAS4tb7yUNOthElQ8wwWW3-Enad3fSi8MVmCsDd6rFfAAHwtp13FMBe90z5duETBnjqt3bLH4k2rTEwbpQHXOhUuSAyHk80Kp7ArXCfUTleCG0Y9cjk_Cj14hkfJDkiAxy5JoHIdk24A43Uip3kvGSKH-xQ0xEEfYtj3_bXgWSYPewKnhJaEP5tZjNpioJFx7_JX-V2iLWVUNRvMJ34ayLHSQC20FQykp1g0110iXaGgT1sWe6SqyVKtu6MwrvefOiuKmk7au6u7i3Ret8vF0xT0REHh3DH9EKsfBmssNzweiWCJg0iYd1CCpzwRfMXtZsoS98DwTCAXl3mtUeoyPvK10MG4ymvnrvTCINbqtBQTsAau0VdAHtGvqxYkhZXkq5-0AmbcRzSuBCYKl2N7prOkaguqHH5Fyb_r1tGZKoOLModNoQFxycTERzxDAzQWWbne7_Tjcf9qYeO7bFRuSUX_C4PbQU9m1wQpEFA-GIIRIq_7LkrQtbsdHnb-Ictnz-HV2b6H-YT9qzl0znQZq3ZW6gWS2PlhD4awPiyvpZSvURkVBhwUuxEvmfl334T2jw4zdWFHQEm7yJcNouwaNbiCgxnfrxmZ2A_d1h9OK-ClahGcYZFqTxF2caRV_JOxcofPPtb_vC5419rwMLjtT39Xlci6XIqHlUSQucWw9-Ai7arykC0ZmK_9ucgHcK50gC7spwIlR7BRlMTo-fT9R9HSy3bmqUCaoNqPsTsnV0GURpfXAnWr_DZdkSNYvN0tOnhWqadfPFAjNJB6PfMzrb6_MTOrf5Vqo6G6zhyezqHNwLH9z_hsyIkC3GFfZIbWrkNhTfhXq1a5yu7sDF8SYFp36qaSIUD8zU5zxFKX373Ua1RENnVzA1KZUDEZFEBr5FaeDCxWpCiv3gEtQ&sai=AMfl-YRkPqEXLIKORl6iSEgIAv5LlFSVa60D2iGZx3-VbwSUmIEt1a9UbNKMDlPKxcrMu1Zap51lSjFSpAGrkHLIj8fEykDMHnOEvUEiCZL91j3kqv3HltEHrFp0ByI0gmcxaBtudYJ-No_CGD1pgkcu_mvS9MhjzKdDDRRD4i2aDrYOZoO4gVc94XaGVBynWRLQQ4s4tHMGJu1ajw2ZB-1qmIC1q9yrcxQ&sig=Cg0ArKJSzI3ag-Pg7muAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=425&cbvp=1&cstd=416&cisv=r20220303.95817&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-31-233-74.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 09 Mar 2022 12:34:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 57F7
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=322896887&d_campaign=26938792&d_bust=4026727337&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=322896887&d_campaign=26938792&d_bust=4026727337&gdpr=&gdp...

42 B
965 B

61ms
61ms

Image
image/gif

52.31.233.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=322896887&d_campaign=26938792&d_bust=4026727337&gdpr=&gdpr_consent=

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

52.31.233.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v029-0e9a6124b.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: avIY+qA4RD8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v029-08b8e9ebc.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: hGxVYPsqTBM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=322896887&d_campaign=26938792&d_bust=4026727337&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 57F7 43 B
1 KB 260ms
70ms Image
image/gif 213.202.235.8
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=25742660&extPm=396917636&extCr=15577051174&gdpr=&gdpr_consent=&rnd=4026727337

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

213.202.235.8 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mi, 09 Mrz 2022 12:34:00 GMT
Server: Microsoft-IIS/8.5
Date: Wed, 09 Mar 2022 12:33:59 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/6657181183598343709/ Frame 6C5D 6 KB
2 KB 54ms
54ms Stylesheet
text/css 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6657181183598343709/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2392bb69de9eb1e9efad1da54204d43b70c52e5b6004b053d1e645fac906ac3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 20:02:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59518
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1741
x-xss-protection: 0
last-modified: Wed, 05 May 2021 19:27:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Mar 2023 20:02:02 GMT

GET
H3 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 6C5D 109 KB
37 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 20:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58942
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 09 Mar 2022 20:11:38 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame 6C5D 59 KB
22 KB 143ms
51ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1704399
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=37KHH3GkI1bICXBDe2RtWceoqI21E6NvN238FQMDUORWZ5880CUSKq5HRtGsugpNm1SOl4U9uEezDbSU1mNy2s01gKt0zfy7By59QpbQN2o%2Fj69oh3973EYDe6EZSeDTirzXp0JWHEE7HRlwWcq0hU8V"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6e93d7a1082971c0-LHR
expires: Mon, 27 Feb 2023 12:34:00 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D540 0
60 B 91ms
91ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssb70pcnOhm4ipJ5jh1FuwcWWps-1zrTGzu3FN1SaiYJdQBmyooykN81megxr0RmkBKSnN6C6UlJyoHiebticNQLt6X-tTemKAsyyVUJZotGs5AYUpSyfzacF66BeI89T6X0PmIIyMp4Xwe_JwM9zTp4vpYga_RvfY5-TaNyqFCDyadiRM-mfKBqdA5HikbDzqH9VX4j4poztcRqONRRx_n6XW5YMeS3PP45nbLXuJADcBXhRPkxYpQ2sdlBg4e_uozNdJV-9-18_qjmw55OQRS3jlFQz42GUQk8UlpcxPY0Ef96AF0EESWRrx1X3g0pnTMoneJJohKhfUyl4IBHCxDA7V6lQnwaZWksZZ9rDLPEPqSctR2-ZjTz0V5oVbgutzSAWMWlg_B0r1pyOgFh33LZ6xLllPJmQFmTvRl_FKzTr49IwjoEHUzfVPalyrLJCRo5FXBh6WlR0hCHwL8POslqiqO7J_S8vEBA9MboW5-oALL8JBjlKmVa7ucpzWNFQNVkmJNS9VvwU6--dyNLrtC9PSRfeCPCZPXChNTXGak774sYMwTO5jJUoNVxUeZgLYabUJyDtp2qXv5siui7eKYo0AK6kN8PeZFOHmb_tyg2MGI0zTZVXOQwtJh_PX3KrU53_inokLgOJa0ge-fPbq4cum5uK7OuPhymABdhZZRuTRyDGs3eeGBSS8R85lx1vM9DAh8cC2l07OMeqZ0uv6iVi5tNsEhHJkIQhsTdrTAQ4hdHfGEvyFjh623LbjHkOIGuR4Te6Hfr977xUMrqQt9Lm1QDl_RmABoMnFGqZfqhReiYiNKKL0GbtkOFswvKdTJX-UJ3P1k17paEbyLrLwoxHnjf2rYCRjjWtrjckLAOO53CPuyWF9UpOI-kg_sQ7XIxeCYDNJPoYBGtk3RJ-zu7g05m4UNBuzANdY4yoadrbAYrhPSFj9DWgrgCNwPg5PlSWug9kLIO7d3lF5zh7F9gEQepvPEuP63AOZCZUTltACf84wmGjJDvFQhOUffVSaAt10LDiI8eA1rVcDOGdm6RCkSx3UhQmrKZWUH4Yfwl46BMOdJC02RGUr72SwzZeXKcNcAMNQkeaQA9t59V2Mb7j7rcATwsoDoRIiR5SmXr6X7L-XS77G-6TUylw3fderup61XkQIdXESNIm503xEZM9csZgMiOH2cFlZSh3_9wQTEN3IKt0_XRrWcrF1fNdymR53nBCYIBWPEajMrCvOYq6FASS_MttLN6i8BqUf3W7Hq277_ZcFhlYxhA-4S&sai=AMfl-YQdxLT4THR-5WpUOmnHOP-_rRAkJpDDXzRAgI8bDSd_kvSf7WiMrBe4iFEmMsUf23GztkFOLWAAKV-lK5HY9ecEiYznn9xyLo8G7JEilThuiI9J-jPJINTvNMGgUhln-iXmPk0P7lwLcwtrOg_wy7SK9m0OIE0VhK7GkgBwsJqh4JjuZ1_SyZoD8m3ApstdpRzyPFiibz2IEBoqgv5Lt6vJM-ukk_s&sig=Cg0ArKJSzKfWIqx1sU-LEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=544&vt=11&dtpt=158&dett=3&cstd=374&cisv=r20220303.95445&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 621cafa7242430397e02cb4b Show response
c.bannerflow.net/a/ Frame EF38 89 KB
31 KB 172ms
66ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/621cafa7242430397e02cb4b?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssg5dPHXvybqifOa7bWxM5H7NkXEcL6-m2dJvuxnFFDxtSGMDSoZUZ-h5r-9dHhi5ScB-XFP6sM8rJBJqfSVifLPSfQ8zpnUSR6-q0EFF2DU95gx_fPHBJdb1efsEcNE69osxSHFoij0vPMJB9NwYXaLcb4sdb3mq3PUi5lVzH_x7EwQn3s4ZgVD-Nw-vtsMDFrMRtsD9PKHi6-PL-1oBNnfGqYKA0frmWvMszZkNIWEQqOTLhp5o7f7Tvl5oapA-2gLtPK1FqDFhgmgzz1DSedMOxuWxaQBf0tjg4_mMJXCnwoMl7C-flrNH_dkUZhceC31ggq_U8efbCLDYi07HlCDwAIcYgL8MLFDEsQde8IHUSFCXn1ywXH1kmPBdr80MJ_uEEaiJL6M1frQCACXZPGiXwyXhBUAJFFaa1zk2L9wqHAwFTSZOSynngjnx3j8fblNEEvE3N9KiLjf5NJEqIKUiMK-lJwA2QWTpE9O_GyNNahb6tR3fb7Nt2gReEboAzS95eJbFXwQza-msRJWQGleCDqMKPGitemrGyKJ5wfdoodzV-PEFXovyOuVXFNrZ3Grxwl_z5Qpaw0ObCs7bbItnbBmzFnC8jO0rgVm3YMSv9xctE_wcY1Y7msVW-bkfBheNSLL2D3LCG2-juo-fTnhe_Nf-8-tRCKaQQHe3CzpeD7EgbroN2vCoY_SRv0ADdBZLjE4bAlMZswmvvipU66R8MrL6SuP7HUEzXdhXn8s-Yxl9owvyfh7dRmOm2uQq64WMh-qJQyC81NSWccYqxXmqshGoXvMu-lyGXHmiq8X3zkQWMSV_BWITHfTkPNOr0soZjxewCXhdLGRWPYn8XR2cAkkpnzxuwDTkazJKJFyhiarGMQfnp62EwCQmJUaXHQYefSKdg6FWZOSNc7aUoiZclWI3ZM8nfKnqvkKfYu14G3lfEk0CoH_B677qsPsvIu47TPOgy4HQTXYJd3-nj7Gr7MVz27_sQmR3JssNn3vng8sFsahATDSVpK0cfLil6y-Duv1crhs6EDUJ7rzAoyywuAfGI1HVuwqFt8NBpZjWr9irVVde7a5wDSdJ-K76HeDqHFD1aM1w6ua4AyF08pyNuRBY4BYPsuxfaP_-2SuDjHp9znnHUx3ISpecQpwjC3ccEgllCHYwD7cCdPJSY0iVpDzTe4QZskxWMaJ7cdEefRNW2qpUiUJr-WM06ij0nzpr2QWZkWWba787BOL03Q44-JIK_2lHU%26sai%3DAMfl-YRGfldbz1T8Km_wWt3P6DKo6KgcQRfFOpTzLnN7oqh5IW2jwzE2vurVKYTfIYf0Pe9xcX__QDBC0DTJiUhsFvTDSdwePLZBAD-UG7KbDkVJQq4U_C5So50Ri9XbVGeu9pfu_-LTzBaaNusE4sKUvPCBJg7y0rM3CI8c4GpR8X78jsP8JGzFQ75aOH5jCQ0XWaojlCf5Hd_uGrV7XDHG7Rr9KPlxS7FVFxYsshCRwA%26sig%3DCg0ArKJSzNP1779_4A3xEAE%26cry%3D1%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D7804798%26adurl%3Dhttps%253A%252F%252Fwww.home24.de%252Ftv-werbespot%252F%253Fdclid%253D%2525edclid!
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9507312078034042880/DE_makeover_garden_2022_mid_funnel_balkon_300x250_html5_banner-637816440224682097-eafd3144-dede-4075-880f-d9e591f29371.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c39dbf472ae7247caa926911f9c2bebdb99152f25e3762c58fc986dc05d3214

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cf-ray: 6e93d7a16de87779-LHR
link: <https://c.bannerflow.net/accounts/home24/60d98659b53a0dc91abcaef0/published/1856991/2129088/preload.jpg>; rel=preload; as=image
request-context: appId=cid-v1:8ccc0d93-c9cf-4965-a9de-1823f9df557e

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
208 B 60ms
60ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1131 0
20 B 90ms
90ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2WHdt54oYrSbKeXI7_UPnfalsAUAAAAAOAHgBAI&bg=!fX6lfjrNAAb7UztL-1M7ACkAdvg8WhjiAwu5o-XS6GLcjweDItMpK2R-CcnkkxMG5OqLXpmhREX05gIAAADzUgAAAAJoAQcKAIn8nePQ1BztscZMkFs-ADWFGcKRdr4qO3Xak5FGFsDwvNQTKS6pA2IzGSx3AXZ8JFnud2TF0w74643dAIwNfVZWIbGE-W2sVBOvqP2zSA5nDKFk0wCh-fw4g-UDQ08qZg5suGWTzQa4Z34qfzr9NEXzf_ekWjxN7BIZK3iSfiRHb58Ng6XNZhrZxZkC8z_YXN4NB_Iu4shALQTVBbDfuBIslxmjtC9xT00-zPnNBFzIB9R-6hkRVpFxMCOZm7iM6wiKp1TYmRV4f-GxZvErJVh3saayTqWXuh3Av-0UpBtvwbNrAdLtjKh9DNRTceRU-wo1bl1MCG31X6PhhO6PIqrODPJheZvLnI-nBFBxHC8B4gA6vghJvnbltkR6VE3nsAZWGpJSxzrililyIr0c1pQxeZFHINnQKqgq_r_wSV2CgNx91ch7Bt0zBDGQSR68TXqQb-9Og4K6uSGXZj5rInKlzeDaMoZj1rr1kawel_nrf29P3QvfGYttBED_NErbrEW4Z05j9Hf3-XtkC6XKgT-Pr8UyEw_hbzfuDgPlv3IBE0HaXuJEQmqAcfPfLnuvByatMFQzFiRf8nwBETKXDtpKvaHPm8Cyu8k_oq44-GzSuQC04bZHGIxSjP85DMIVoyHSoVCrLF53Q64-F_MRQt76NxHbSlK5lJiUEy8Z4hYueNeoKho4SYAb6Fd9qUUf92-E_r0ifj8JFHBv1Ve7wbBhJvQ4YBB7B8RwKl6v8aEKJE106tFbqvfKKOwCirj1qAhHSBFGNKLIa02P1nb_d_-CMYHcoTwT-vTSIi94GcTiK8fLg1Z08FOhhTumBh2mcb-wk4o4-jU8JOLx9jwLiTwtNrqzv_ybiJl9RotAJFUGszCJcp3rXQTkcyaLZ0KWTKXwnBQPc8b_61YajCXI-xidkQFXO6uhh7FkFu8A-hSsf4npbzEBUNDlelL-Xk2aJNcK1CmFn61Bs8gUcTVkbDWohkfcmoz3PA2ypvXwEft_a5EpHBvMWNSUMLH0RxeLgwUyz1wjidApvLrML1N9bIornDkZX0oVICq6WBqGvdjA3hmA-KL54QfKmaSZMwmzFCAfVmXNXp8Sk7lx1ayJNqVObw5cuRArrWt15SmyIXRdVBX3a6jN_rObNR4n5CItCCGEoS2sUzFwVEafkhqhR44ojlRe69iBjtGat-oiVvwK

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F008 0
20 B 89ms
89ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3qbrt54oYvqeKdnP7_UPj8KdMAAAAAA4AeAEAg&bg=!wsGlwYXNAAb7UztL-1M7ACkAdvg8Wq_BFxBtBl7ZqTH5LX5DVnpd0O_7l9pjkn6OF-C41u_ww91s1AIAAACmUgAAAAJoAQeZAu-6GnWxAjksc2gRi7c1vfz33dJyeH64a1UiNo2NZrOlQ0ksXqzCc0bv0BN1i7SGN7XFWLcb6vHAuWPwkeQSl4_4n40fpEvuM-wO3UncZsVBVQFTgwpbefJ7N1SY-MHUsUbRK8wsmpaA2bpQm16_A7vghYHXJx02CjHh1B6WCbtNCWklJQ_ekwHl6jMqTbxbmbyGroLxWBtAzSGkwvh9boISu-aB0WBlIp9P1yOQX2LNq5xceepB2Hvn-XTu6VMawNJNT3gTDpeVEx32ueIpCXUKCcz4x8ze3MnQLxqlF_njR5Q6PDsU_s9LKYrMhTCJ6wl5CpHtNeUhCnl1TdfoKPP0N_81l4Yf3fm9_ql0thHR2tbq4WAc9cOpxJ9gm6CcpFyOf1Tp0J_y5bSs5pL_YDnYfYvNZlzYT4oPfp-Yd_zns8HZdnA6qxLYGvKkOqYMIhAy_pcn464ZmndAFwrPskflFwaSAbY1Xj1f0EGqUhKymw2OswlLNBoidYZCdIsAA7G0czHTc3zwhuqMB_DYkRcRN7HqHdwoJenNOvn8dso5jIBXEmWWAP-vt9iW3aEpamGOYkRwr8me3qjB0wA5sCcC-1iblpnMJqgZPZRaz6bjIloLNN3bwl2aAo_LYP2u6T1ZQ9o4rEtzJQgcWit2rAJ5oqGYqRjT094-FBaaT7Y4RV-1ed98ciTVPztVmyjuWWMBgTCQRkTXU39K34RexTMFhp1UCD5_G-8_4ObWASvIXzzpHWIa-3mmx8j5ojRKBhLQZLwZtWw5ObHcab0VhnxMnDCA9H47_YlhGJTwdz5IAPWdhK9Nq_RqQWP7rgBy6tbvwfuitzoQVVIsWk40caWP1J0xc6hibocA3XJIg-A69GQaVkel5KlI2v_-pgmGs9C1dLvafbOnW1NtQO2rP4v-qrLusLqYnBF0NEx5j_qNeLhJBfRHNbpCrolzdnjgY3uPhuD_duGmUAjoCq6ng1NvecmVNrlQpC8h1KtB2Jkj

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6C5D 7 KB
5 KB 66ms
65ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_244&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76a8249c068c041831fc9ea0f196d0348eb4f7de19b0725afc12fe2c2c0eeb63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5491
x-xss-protection: 0

GET
H3 200 blank.png_1621952972643_blank.png
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame 6C5D 95 B
120 B 55ms
54ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/blank.png_1621952972643_blank.png

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 23:27:00 GMT
x-content-type-options: nosniff
age: 47220
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
last-modified: Tue, 25 May 2021 14:29:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 23:27:00 GMT

GET
H3 200 DCO_1110_1608_Res_SkyQ_over_IP_Update2_FTA_HD_300x250_1.jpg_1630073582816_DCO_1110_1608_Res_SkyQ_over_IP_Update2_FTA_HD_300x250_1.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame 6C5D 27 KB
27 KB 82ms
81ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_1110_1608_Res_SkyQ_over_IP_Update2_FTA_HD_300x250_1.jpg_1630073582816_DCO_1110_1608_Res_SkyQ_over_IP_Update2_FTA_HD_300x250_1.jpg

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a14b912a4ac3fdccdbe333af803027a736728f4708d11ab423e3b869ce0ab3e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 03:57:30 GMT
x-content-type-options: nosniff
age: 30990
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27428
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 14:13:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Mar 2023 03:57:30 GMT

GET
H3 200 DCO_1110_1608_Res_SkyQ_over_IP_Update2_300x250_2.jpg_1630071085498_DCO_1110_1608_Res_SkyQ_over_IP_Update2_300x250_2.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame 6C5D 33 KB
33 KB 55ms
55ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_1110_1608_Res_SkyQ_over_IP_Update2_300x250_2.jpg_1630071085498_DCO_1110_1608_Res_SkyQ_over_IP_Update2_300x250_2.jpg

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

258f56c092f3255b90e350f1e86a494ec785bd3094937ff252ff9242c9959cef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 02 Mar 2022 16:04:54 GMT
x-content-type-options: nosniff
age: 592146
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33609
x-xss-protection: 0
last-modified: Fri, 27 Aug 2021 13:31:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Mar 2023 16:04:54 GMT

GET
H3 200 DCO_1110_1608_Res_SkyQ_over_IP_Update_300x250_4.jpg_1636452223006_DCO_1110_1608_Res_SkyQ_over_IP_Update_300x250_4.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame 6C5D 29 KB
29 KB 95ms
94ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_1110_1608_Res_SkyQ_over_IP_Update_300x250_4.jpg_1636452223006_DCO_1110_1608_Res_SkyQ_over_IP_Update_300x250_4.jpg

Requested by

Host: 0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com
URL: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4515dbf25fc6587ee649bcaaf293d81eb2c54543d5988ce1c526d2d9b1920339

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=cCCKQ5lAn9&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 23:10:05 GMT
x-content-type-options: nosniff
age: 48235
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29673
x-xss-protection: 0
last-modified: Tue, 09 Nov 2021 10:03:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 23:10:05 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 57F7 0
23 B 171ms
109ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssw9hFRhspGxBD45xcrg3YIBAFcxkkpdy5xPmhmJtXMJfewXEiRgR3cjv58paTIvGJC61UElCYULnGFIk9ejrfpZX-P-5e9vsjE5_UMLDzJSZRPN9YvVobLkxyboJtV2lfuIf6XUDpJEFo5QQOFohqMODax9efQW68bjO3FQi7MMngz6DM_zGKaSUyPFfsY2MIe30BIwW3FxxBrQd9Q9HTu2aYCFIMWF7u4YHG285jSXXsJw0-FlJ1p8L2dwqPPRifWz69FDfqbHqaDm-6CVK77id1NVZPcBW26bCBZwKx-ske9pjNKw308g1AJFHU8Ha28SwUbvNZ_EFneZQJEufvDR0k1IrzbFU6nezAS4tb7yUNOthElQ8wwWW3-Enad3fSi8MVmCsDd6rFfAAHwtp13FMBe90z5duETBnjqt3bLH4k2rTEwbpQHXOhUuSAyHk80Kp7ArXCfUTleCG0Y9cjk_Cj14hkfJDkiAxy5JoHIdk24A43Uip3kvGSKH-xQ0xEEfYtj3_bXgWSYPewKnhJaEP5tZjNpioJFx7_JX-V2iLWVUNRvMJ34ayLHSQC20FQykp1g0110iXaGgT1sWe6SqyVKtu6MwrvefOiuKmk7au6u7i3Ret8vF0xT0REHh3DH9EKsfBmssNzweiWCJg0iYd1CCpzwRfMXtZsoS98DwTCAXl3mtUeoyPvK10MG4ymvnrvTCINbqtBQTsAau0VdAHtGvqxYkhZXkq5-0AmbcRzSuBCYKl2N7prOkaguqHH5Fyb_r1tGZKoOLModNoQFxycTERzxDAzQWWbne7_Tjcf9qYeO7bFRuSUX_C4PbQU9m1wQpEFA-GIIRIq_7LkrQtbsdHnb-Ictnz-HV2b6H-YT9qzl0znQZq3ZW6gWS2PlhD4awPiyvpZSvURkVBhwUuxEvmfl334T2jw4zdWFHQEm7yJcNouwaNbiCgxnfrxmZ2A_d1h9OK-ClahGcYZFqTxF2caRV_JOxcofPPtb_vC5419rwMLjtT39Xlci6XIqHlUSQucWw9-Ai7arykC0ZmK_9ucgHcK50gC7spwIlR7BRlMTo-fT9R9HSy3bmqUCaoNqPsTsnV0GURpfXAnWr_DZdkSNYvN0tOnhWqadfPFAjNJB6PfMzrb6_MTOrf5Vqo6G6zhyezqHNwLH9z_hsyIkC3GFfZIbWrkNhTfhXq1a5yu7sDF8SYFp36qaSIUD8zU5zxFKX373Ua1RENnVzA1KZUDEZFEBr5FaeDCxWpCiv3gEtQ&sai=AMfl-YRkPqEXLIKORl6iSEgIAv5LlFSVa60D2iGZx3-VbwSUmIEt1a9UbNKMDlPKxcrMu1Zap51lSjFSpAGrkHLIj8fEykDMHnOEvUEiCZL91j3kqv3HltEHrFp0ByI0gmcxaBtudYJ-No_CGD1pgkcu_mvS9MhjzKdDDRRD4i2aDrYOZoO4gVc94XaGVBynWRLQQ4s4tHMGJu1ajw2ZB-1qmIC1q9yrcxQ&sig=Cg0ArKJSzI3ag-Pg7muAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=674&vt=11&dtpt=249&dett=3&cstd=416&cisv=r20220303.95817&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.gismeteo.ua
URL: https://www.gismeteo.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sky_medium.woff
s0.2mdn.net/creatives/assets/3668815/ Frame 6C5D 27 KB
27 KB 56ms
56ms Font
font/woff 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:31:53 GMT
x-content-type-options: nosniff
age: 127
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27952
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 09 Mar 2022 12:46:53 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6C5D 17 KB
6 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 09 Mar 2022 12:34:00 GMT

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/home24/60d98659b53a0dc91abcaef0/published/1856991/2129088/ Frame EF38 25 KB
26 KB 58ms
58ms Image
image/jpeg 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/home24/60d98659b53a0dc91abcaef0/published/1856991/2129088/preload.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 875bd4917410e6c14f1c248945cc4abf81d2130835d3ad5caec396dd789f562a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 09 Mar 2022 12:34:00 GMT
cf-cache-status: HIT
age: 571560
content-length: 26068
x-ms-lease-status: unlocked
last-modified: Mon, 28 Feb 2022 11:20:03 GMT
server: cloudflare
etag: 0x8D9FAAC446609FA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 64c9527d-301e-0056-727f-2e1cc9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6e93d7a1dee27779-LHR
cf-bgj: h2pri

GET
H2 200 widget.67d07b3d1b2b191462ff.js Show response
c.bannerflow.net/scripts/ Frame EF38 19 KB
7 KB 53ms
52ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.67d07b3d1b2b191462ff.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/621cafa7242430397e02cb4b?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssg5dPHXvybqifOa7bWxM5H7NkXEcL6-m2dJvuxnFFDxtSGMDSoZUZ-h5r-9dHhi5ScB-XFP6sM8rJBJqfSVifLPSfQ8zpnUSR6-q0EFF2DU95gx_fPHBJdb1efsEcNE69osxSHFoij0vPMJB9NwYXaLcb4sdb3mq3PUi5lVzH_x7EwQn3s4ZgVD-Nw-vtsMDFrMRtsD9PKHi6-PL-1oBNnfGqYKA0frmWvMszZkNIWEQqOTLhp5o7f7Tvl5oapA-2gLtPK1FqDFhgmgzz1DSedMOxuWxaQBf0tjg4_mMJXCnwoMl7C-flrNH_dkUZhceC31ggq_U8efbCLDYi07HlCDwAIcYgL8MLFDEsQde8IHUSFCXn1ywXH1kmPBdr80MJ_uEEaiJL6M1frQCACXZPGiXwyXhBUAJFFaa1zk2L9wqHAwFTSZOSynngjnx3j8fblNEEvE3N9KiLjf5NJEqIKUiMK-lJwA2QWTpE9O_GyNNahb6tR3fb7Nt2gReEboAzS95eJbFXwQza-msRJWQGleCDqMKPGitemrGyKJ5wfdoodzV-PEFXovyOuVXFNrZ3Grxwl_z5Qpaw0ObCs7bbItnbBmzFnC8jO0rgVm3YMSv9xctE_wcY1Y7msVW-bkfBheNSLL2D3LCG2-juo-fTnhe_Nf-8-tRCKaQQHe3CzpeD7EgbroN2vCoY_SRv0ADdBZLjE4bAlMZswmvvipU66R8MrL6SuP7HUEzXdhXn8s-Yxl9owvyfh7dRmOm2uQq64WMh-qJQyC81NSWccYqxXmqshGoXvMu-lyGXHmiq8X3zkQWMSV_BWITHfTkPNOr0soZjxewCXhdLGRWPYn8XR2cAkkpnzxuwDTkazJKJFyhiarGMQfnp62EwCQmJUaXHQYefSKdg6FWZOSNc7aUoiZclWI3ZM8nfKnqvkKfYu14G3lfEk0CoH_B677qsPsvIu47TPOgy4HQTXYJd3-nj7Gr7MVz27_sQmR3JssNn3vng8sFsahATDSVpK0cfLil6y-Duv1crhs6EDUJ7rzAoyywuAfGI1HVuwqFt8NBpZjWr9irVVde7a5wDSdJ-K76HeDqHFD1aM1w6ua4AyF08pyNuRBY4BYPsuxfaP_-2SuDjHp9znnHUx3ISpecQpwjC3ccEgllCHYwD7cCdPJSY0iVpDzTe4QZskxWMaJ7cdEefRNW2qpUiUJr-WM06ij0nzpr2QWZkWWba787BOL03Q44-JIK_2lHU%26sai%3DAMfl-YRGfldbz1T8Km_wWt3P6DKo6KgcQRfFOpTzLnN7oqh5IW2jwzE2vurVKYTfIYf0Pe9xcX__QDBC0DTJiUhsFvTDSdwePLZBAD-UG7KbDkVJQq4U_C5So50Ri9XbVGeu9pfu_-LTzBaaNusE4sKUvPCBJg7y0rM3CI8c4GpR8X78jsP8JGzFQ75aOH5jCQ0XWaojlCf5Hd_uGrV7XDHG7Rr9KPlxS7FVFxYsshCRwA%26sig%3DCg0ArKJSzNP1779_4A3xEAE%26cry%3D1%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D7804798%26adurl%3Dhttps%253A%252F%252Fwww.home24.de%252Ftv-werbespot%252F%253Fdclid%253D%2525edclid!
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe45e54caa92d39632e4f21b896a00320d45368615778680d0ae03e4290127a7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: +WCQZ6jzobF0nADjBsw30Q==
age: 1194169
cf-polished: origSize=19181
x-ms-lease-status: unlocked
last-modified: Wed, 23 Feb 2022 10:31:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 09d1d0de-e01e-006a-1bd5-28350e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6e93d7a1ef047779-LHR
cf-bgj: minify

GET
H2 200 document.b019e5500a.js Show response
c.bannerflow.net/accounts/home24/60d98659b53a0dc91abcaef0/published/1856991/2129088/ Frame EF38 23 KB
6 KB 55ms
55ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/home24/60d98659b53a0dc91abcaef0/published/1856991/2129088/document.b019e5500a.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/621cafa7242430397e02cb4b?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssg5dPHXvybqifOa7bWxM5H7NkXEcL6-m2dJvuxnFFDxtSGMDSoZUZ-h5r-9dHhi5ScB-XFP6sM8rJBJqfSVifLPSfQ8zpnUSR6-q0EFF2DU95gx_fPHBJdb1efsEcNE69osxSHFoij0vPMJB9NwYXaLcb4sdb3mq3PUi5lVzH_x7EwQn3s4ZgVD-Nw-vtsMDFrMRtsD9PKHi6-PL-1oBNnfGqYKA0frmWvMszZkNIWEQqOTLhp5o7f7Tvl5oapA-2gLtPK1FqDFhgmgzz1DSedMOxuWxaQBf0tjg4_mMJXCnwoMl7C-flrNH_dkUZhceC31ggq_U8efbCLDYi07HlCDwAIcYgL8MLFDEsQde8IHUSFCXn1ywXH1kmPBdr80MJ_uEEaiJL6M1frQCACXZPGiXwyXhBUAJFFaa1zk2L9wqHAwFTSZOSynngjnx3j8fblNEEvE3N9KiLjf5NJEqIKUiMK-lJwA2QWTpE9O_GyNNahb6tR3fb7Nt2gReEboAzS95eJbFXwQza-msRJWQGleCDqMKPGitemrGyKJ5wfdoodzV-PEFXovyOuVXFNrZ3Grxwl_z5Qpaw0ObCs7bbItnbBmzFnC8jO0rgVm3YMSv9xctE_wcY1Y7msVW-bkfBheNSLL2D3LCG2-juo-fTnhe_Nf-8-tRCKaQQHe3CzpeD7EgbroN2vCoY_SRv0ADdBZLjE4bAlMZswmvvipU66R8MrL6SuP7HUEzXdhXn8s-Yxl9owvyfh7dRmOm2uQq64WMh-qJQyC81NSWccYqxXmqshGoXvMu-lyGXHmiq8X3zkQWMSV_BWITHfTkPNOr0soZjxewCXhdLGRWPYn8XR2cAkkpnzxuwDTkazJKJFyhiarGMQfnp62EwCQmJUaXHQYefSKdg6FWZOSNc7aUoiZclWI3ZM8nfKnqvkKfYu14G3lfEk0CoH_B677qsPsvIu47TPOgy4HQTXYJd3-nj7Gr7MVz27_sQmR3JssNn3vng8sFsahATDSVpK0cfLil6y-Duv1crhs6EDUJ7rzAoyywuAfGI1HVuwqFt8NBpZjWr9irVVde7a5wDSdJ-K76HeDqHFD1aM1w6ua4AyF08pyNuRBY4BYPsuxfaP_-2SuDjHp9znnHUx3ISpecQpwjC3ccEgllCHYwD7cCdPJSY0iVpDzTe4QZskxWMaJ7cdEefRNW2qpUiUJr-WM06ij0nzpr2QWZkWWba787BOL03Q44-JIK_2lHU%26sai%3DAMfl-YRGfldbz1T8Km_wWt3P6DKo6KgcQRfFOpTzLnN7oqh5IW2jwzE2vurVKYTfIYf0Pe9xcX__QDBC0DTJiUhsFvTDSdwePLZBAD-UG7KbDkVJQq4U_C5So50Ri9XbVGeu9pfu_-LTzBaaNusE4sKUvPCBJg7y0rM3CI8c4GpR8X78jsP8JGzFQ75aOH5jCQ0XWaojlCf5Hd_uGrV7XDHG7Rr9KPlxS7FVFxYsshCRwA%26sig%3DCg0ArKJSzNP1779_4A3xEAE%26cry%3D1%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D7804798%26adurl%3Dhttps%253A%252F%252Fwww.home24.de%252Ftv-werbespot%252F%253Fdclid%253D%2525edclid!
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ccf52e3a8a092b222f9de6f5bdc470490ed9c851ff4b742552f5654ea1cf6ac

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: sBnlUAogfNacIG37hMetRg==
age: 571559
cf-polished: origSize=25567
x-ms-lease-status: unlocked
last-modified: Mon, 28 Feb 2022 11:20:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f012ae1d-701e-009c-157f-2e4040000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6e93d7a1ef077779-LHR
cf-bgj: minify

GET
H2 200 animated-creative.f67bd37d6ec09b84b344.js Show response
c.bannerflow.net/scripts/ Frame EF38 141 KB
48 KB 59ms
59ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.f67bd37d6ec09b84b344.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/621cafa7242430397e02cb4b?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssg5dPHXvybqifOa7bWxM5H7NkXEcL6-m2dJvuxnFFDxtSGMDSoZUZ-h5r-9dHhi5ScB-XFP6sM8rJBJqfSVifLPSfQ8zpnUSR6-q0EFF2DU95gx_fPHBJdb1efsEcNE69osxSHFoij0vPMJB9NwYXaLcb4sdb3mq3PUi5lVzH_x7EwQn3s4ZgVD-Nw-vtsMDFrMRtsD9PKHi6-PL-1oBNnfGqYKA0frmWvMszZkNIWEQqOTLhp5o7f7Tvl5oapA-2gLtPK1FqDFhgmgzz1DSedMOxuWxaQBf0tjg4_mMJXCnwoMl7C-flrNH_dkUZhceC31ggq_U8efbCLDYi07HlCDwAIcYgL8MLFDEsQde8IHUSFCXn1ywXH1kmPBdr80MJ_uEEaiJL6M1frQCACXZPGiXwyXhBUAJFFaa1zk2L9wqHAwFTSZOSynngjnx3j8fblNEEvE3N9KiLjf5NJEqIKUiMK-lJwA2QWTpE9O_GyNNahb6tR3fb7Nt2gReEboAzS95eJbFXwQza-msRJWQGleCDqMKPGitemrGyKJ5wfdoodzV-PEFXovyOuVXFNrZ3Grxwl_z5Qpaw0ObCs7bbItnbBmzFnC8jO0rgVm3YMSv9xctE_wcY1Y7msVW-bkfBheNSLL2D3LCG2-juo-fTnhe_Nf-8-tRCKaQQHe3CzpeD7EgbroN2vCoY_SRv0ADdBZLjE4bAlMZswmvvipU66R8MrL6SuP7HUEzXdhXn8s-Yxl9owvyfh7dRmOm2uQq64WMh-qJQyC81NSWccYqxXmqshGoXvMu-lyGXHmiq8X3zkQWMSV_BWITHfTkPNOr0soZjxewCXhdLGRWPYn8XR2cAkkpnzxuwDTkazJKJFyhiarGMQfnp62EwCQmJUaXHQYefSKdg6FWZOSNc7aUoiZclWI3ZM8nfKnqvkKfYu14G3lfEk0CoH_B677qsPsvIu47TPOgy4HQTXYJd3-nj7Gr7MVz27_sQmR3JssNn3vng8sFsahATDSVpK0cfLil6y-Duv1crhs6EDUJ7rzAoyywuAfGI1HVuwqFt8NBpZjWr9irVVde7a5wDSdJ-K76HeDqHFD1aM1w6ua4AyF08pyNuRBY4BYPsuxfaP_-2SuDjHp9znnHUx3ISpecQpwjC3ccEgllCHYwD7cCdPJSY0iVpDzTe4QZskxWMaJ7cdEefRNW2qpUiUJr-WM06ij0nzpr2QWZkWWba787BOL03Q44-JIK_2lHU%26sai%3DAMfl-YRGfldbz1T8Km_wWt3P6DKo6KgcQRfFOpTzLnN7oqh5IW2jwzE2vurVKYTfIYf0Pe9xcX__QDBC0DTJiUhsFvTDSdwePLZBAD-UG7KbDkVJQq4U_C5So50Ri9XbVGeu9pfu_-LTzBaaNusE4sKUvPCBJg7y0rM3CI8c4GpR8X78jsP8JGzFQ75aOH5jCQ0XWaojlCf5Hd_uGrV7XDHG7Rr9KPlxS7FVFxYsshCRwA%26sig%3DCg0ArKJSzNP1779_4A3xEAE%26cry%3D1%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D7804798%26adurl%3Dhttps%253A%252F%252Fwww.home24.de%252Ftv-werbespot%252F%253Fdclid%253D%2525edclid!
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b973308f28a2ddc0f23aad2e84a41c57a795c11a5a11a9dd69ff99c6bd86bd6

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: Mv8+K0VHX0XfspYUov7VTw==
age: 1197142
cf-polished: origSize=144956
x-ms-lease-status: unlocked
last-modified: Wed, 23 Feb 2022 10:31:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0446da37-901e-0060-38ce-2891b9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6e93d7a1ef0b7779-LHR
cf-bgj: minify

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
208 B 65ms
65ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.gismeteo.ua/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Wed, 09 Mar 2022 12:34:00 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H3 200 sky_regular.woff
s0.2mdn.net/creatives/assets/3668815/ Frame 6C5D 33 KB
33 KB 64ms
64ms Font
font/woff 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f738547bbcdbef189de47347ad84fc0bb0c15164980f51a0214706fa5c94a73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:31:47 GMT
x-content-type-options: nosniff
age: 133
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33980
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 09 Mar 2022 12:46:47 GMT

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame 95FA 38 KB
14 KB 228ms
58ms Document
text/html 2.21.141.175
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.175 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-175.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 877fa64eb78a65e1b23fef6c4acd56fd991c23f286250122e75c89b97e2cd405

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

last-modified: Tue, 11 Jan 2022 05:13:08 GMT
etag: "1302647-9687-5d547824a78f1"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13928
content-type: text/html; charset=UTF-8
cache-control: public, max-age=41089
expires: Wed, 09 Mar 2022 23:58:49 GMT
date: Wed, 09 Mar 2022 12:34:00 GMT
vary: Accept-Encoding

GET
H2 200 sspmatch-iframe Show response
ads.betweendigital.com/ Frame 824F 658 B
837 B 118ms
97ms Document
text/html 188.42.29.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/sspmatch-iframe
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.42.29.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 80b50c57631c4b54c74e0ef8c19767da20e87b8c930ead2e518e3baf9ef11cc7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

content-type: text/html
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 658

GET
H/1.1 204
No Content ks
sync2.adtelligent.com/ Frame 454D 0
0 364ms
112ms Document
text/plain 209.205.217.85
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync2.adtelligent.com/ks?domain={domain}
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.205.217.85 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:00 GMT

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame B947 0
91 B 114ms
72ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.2.0
date: Wed, 09 Mar 2022 12:34:00 GMT
content-type: text/html
content-length: 20
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E891 52 KB
17 KB 208ms
53ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 07 Mar 2022 06:18:19 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 09 Mar 2022 12:34:00 GMT
Age: 25328
X-Served-By: cache-lga21977-LGA, cache-hhn4031-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 3, 447051
X-Timer: S1646829241.862298,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame C2B0 2 KB
1 KB 693ms
216ms Document
text/html 2a06:8640:628:0:ec4:7aff:fe94:33ae
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:8640:628:0:ec4:7aff:fe94:33ae Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: ddc03583a963e556695904137854679ca5a2f5a5ec9868d3efe9abd93770f3d1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

Server: Adtelligent
Date: Wed, 09 Mar 2022 12:34:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 867
Access-Control-Allow-Origin: https://www.gismeteo.ua
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame 376E 3 KB
2 KB 252ms
60ms Document
text/html 2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

Server: Apache
Last-Modified: Fri, 18 Feb 2022 16:05:37 GMT
ETag: "e20015-b6b-5d84d0db0c30a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 09 Mar 2022 12:34:00 GMT
Content-Length: 1388
Connection: keep-alive

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6888 2 KB
814 B 217ms
62ms Document
text/html 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=59a18369e249bfb

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame A4C8 281 B
554 B 203ms
56ms Document
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/assets/hb/gismeteoua.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 09 Mar 2022 12:34:00 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 prebid
rtb.openx.net/sync/ 43 B
351 B 211ms
63ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/prebid?gdpr={gdpr}&gdpr_consent={gdpr_consent}&r=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309255%26extuid%3D%24%7BUID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:00 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 5gl89da1achmkrd9dlba63758cd6dhju

GET
H/1.1 204
No Content merge
ce.lijit.com/ 0
348 B 202ms
51ms Image
text/plain 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=380632&3pid=2df51a712ece4f52b9a8448f9decff02&us_privacy=$(US_PRIVACY)&gdpr=&gdpr_consent=&location=https%3A%2F%2Finv-nets.admixer.net%2Fadxcm.aspx%3Fssp%3DA0E94EB6-7943-457A-8B17-9C99C6ADCED2%26id%3D%5BSOVRNID%5D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
X-MERGE: GDPR Optout true
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ams1
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ 0
277 B 202ms
54ms Image
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D310570%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 09 Mar 2022 12:34:00 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

admixer
exchange.buzzoola.com/cookiesync/ssp/
Redirect Chain

https://exchange.buzzoola.com/cookiesync/ssp/admixer?uid=2df51a712ece4f52b9a8448f9decff02
https://exchange.buzzoola.com/cookiesync/ssp/admixer?set_buzzoola_cookie=t&uid=2df51a712ece4f52b9a8448f9decff02

43 B
130 B

60ms
59ms

Image
image/gif

49.12.83.94
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://exchange.buzzoola.com/cookiesync/ssp/admixer?set_buzzoola_cookie=t&uid=2df51a712ece4f52b9a8448f9decff02
Protocol: H2
Server: 49.12.83.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.94.83.12.49.clients.your-server.de
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:00 GMT
server: nginx
content-length: 43
serverid: TODO
content-type: image/gif

Redirect headers

location: /cookiesync/ssp/admixer?set_buzzoola_cookie=t&uid=2df51a712ece4f52b9a8448f9decff02
date: Wed, 09 Mar 2022 12:34:00 GMT
server: nginx
etag: W/"d4646a389a24410c0ed577668a55f26ace6fce87b6a3009c4e27cab78a21684c"
content-length: 122
serverid: TODO
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

adxcm.aspx
inv-nets.admixer.net/
Redirect Chain

https://admixer-sync.rutarget.ru/sync
https://inv-nets.admixer.net/adxcm.aspx?ssp=76391747-8C01-44B5-BA9C-B7DA670E100C&id=0w7Lu3clKCHm

43 B
463 B

56ms
56ms

Image
image/gif

146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://inv-nets.admixer.net/adxcm.aspx?ssp=76391747-8C01-44B5-BA9C-B7DA670E100C&id=0w7Lu3clKCHm

Protocol

HTTP/1.1

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

281c5ae8bf152f644e12a943ec5d59681e1950c54fb6c0b3cc77539bf5e69340

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=25
Content-Length: 43
X-Xss-Protection: 0

Redirect headers

location: https://inv-nets.admixer.net/adxcm.aspx?ssp=76391747-8C01-44B5-BA9C-B7DA670E100C&id=0w7Lu3clKCHm
date: Wed, 09 Mar 2022 12:34:01 GMT
server: nginx
content-length: 0
p3p: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H/1.1

200
OK

cm.aspx
inv-nets.admixer.net/bs/
Redirect Chain

https://x.bidswitch.net/sync?ssp=admixer&user_id=2df51a712ece4f52b9a8448f9decff02&gdpr=&gdpr_consent=&us_privacy=[usPrivacy]
https://x.bidswitch.net/ul_cb/sync?ssp=admixer&user_id=2df51a712ece4f52b9a8448f9decff02&gdpr=&gdpr_consent=&us_privacy=[usPrivacy]
https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=admixer&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=admixer&&user_id=LixY_SF7CPw1LVz9fXhH9y0nX_A1LwvyfShxAxZL
https://inv-nets.admixer.net/bs/cm.aspx?id=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&consent=&gdpr_pd=

43 B
463 B

56ms
56ms

Image
image/gif

146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://inv-nets.admixer.net/bs/cm.aspx?id=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&consent=&gdpr_pd=

Protocol

HTTP/1.1

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

281c5ae8bf152f644e12a943ec5d59681e1950c54fb6c0b3cc77539bf5e69340

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=25
Content-Length: 43
X-Xss-Protection: 0

Redirect headers

Location: //inv-nets.admixer.net/bs/cm.aspx?id=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&consent=&gdpr_pd=
Date: Wed, 09 Mar 2022 12:34:01 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

adxcm.aspx
inv-nets.admixer.net/
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43070&callback_url=%2F%2Finv-nets.admixer.net%2Fadxcm.aspx%3Fssp%3D70C88C54-8654-4219-A50A-E344F86A4A28%26id%3D${USER_ID}
https://inv-nets.admixer.net/adxcm.aspx?ssp=70C88C54-8654-4219-A50A-E344F86A4A28&id=1f9c724b-53f5-5144-b20a-5e68d022c0dd

43 B
463 B

57ms
57ms

Image
image/gif

146.0.227.109
VELIANET-AS velia...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://inv-nets.admixer.net/adxcm.aspx?ssp=70C88C54-8654-4219-A50A-E344F86A4A28&id=1f9c724b-53f5-5144-b20a-5e68d022c0dd

Protocol

HTTP/1.1

Server

146.0.227.109 , Ascension Island, ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE),

Reverse DNS

Software

nginx /

Resource Hash

281c5ae8bf152f644e12a943ec5d59681e1950c54fb6c0b3cc77539bf5e69340

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.gismeteo.ua/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:00 GMT
Server: nginx
P3p: CP="NID DSP ALL COR"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=25
Content-Length: 43
X-Xss-Protection: 0

Redirect headers

location: https://inv-nets.admixer.net/adxcm.aspx?ssp=70C88C54-8654-4219-A50A-E344F86A4A28&id=1f9c724b-53f5-5144-b20a-5e68d022c0dd
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H3 200 wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js Show response
pagead2.googlesyndication.com/bg/ Frame 853F 35 KB
13 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wpnNdEHEE-H-HWkGYo82vcEULjX7WQfOj--jYhPbLdo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c299cd7441c413e1fe1d6906628f36bdc1142e35fb5907ce8fefa36213db2dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Tue, 08 Mar 2022 10:58:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 92141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13712
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 17:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Mar 2023 10:58:19 GMT

GET
H2

200

match
ads.betweendigital.com/ Frame 824F
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://x.bidswitch.net/ul_cb/sync?ssp=between
https://event.clientgear.com/cookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=db4dc06a-5af5-4a53-8d62-c6add12222fd
https://x.bidswitch.net/sync?dsp_id=257&user_id=mkc63b6ae1-16c2-4ab9-b087-e1e5f3789cc1&expires=7&user_group=5&ssp=between&bsw_param=db4dc06a-5af5-4a53-8d62-c6add12222fd
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=db4dc06a-5af5-4a53-8d62-c6add12222fd

68 B
607 B

94ms
94ms

Image
image/png

188.42.29.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=22&external_user_id=db4dc06a-5af5-4a53-8d62-c6add12222fd
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 188.42.29.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Location: //ads.betweendigital.com/match?bidder_id=22&external_user_id=db4dc06a-5af5-4a53-8d62-c6add12222fd
Date: Wed, 09 Mar 2022 12:34:01 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
ads.betweendigital.com/ Frame 824F
Redirect Chain

https://px.adhigh.net/p/cm/btw
https://px.adhigh.net/p/cm/btw?bounced=1
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=74E2L7VFpTf.AikABlF_bqwC8Q

68 B
607 B

95ms
95ms

Image
image/png

188.42.29.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=74E2L7VFpTf.AikABlF_bqwC8Q
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 188.42.29.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: nginx
access-control-allow-origin: *
x-backend-id: f15-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=74E2L7VFpTf.AikABlF_bqwC8Q
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

match
ads.betweendigital.com/ Frame 824F
Redirect Chain

https://sync.bumlam.com/?src=bw1&uid=1f9c724b-53f5-5144-b20a-5e68d022c0dd
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABi5vaKRBlIFvp7KygpiJDFmOWM3MjRiLTUzZjUtNTE0NC1iMjBhLTVlNjhkMDIyYzBkZA**
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARi5vaKRBlIFvp7KygpiJDFmOWM3MjRiLTUzZjUtNTE0NC1iMjBhLTVlNjhkMDIyYzBkZKIBEDLdN8afpRHspukAJZDIJDc*
https://sync.bumlam.com/?src=bw1&s_data=CAIQABi5vaKRBmIkMWY5YzcyNGItNTNmNS01MTQ0LWIyMGEtNWU2OGQwMjJjMGRkogEQMt03xp-lEeym6QAlkMgkNw**
https://sync.bumlam.com/?src=bw1&s_data=CAIQARi5vaKRBmIkMWY5YzcyNGItNTNmNS01MTQ0LWIyMGEtNWU2OGQwMjJjMGRkogEQMt03xp-lEeym6QAlkMgkNw**
https://ads.betweendigital.com/match?bidder_id=18&external_user_id=32dd37c6-9fa5-11ec-a6e9-002590c82437

68 B
607 B

95ms
93ms

Image
image/png

188.42.29.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=32dd37c6-9fa5-11ec-a6e9-002590c82437
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 188.42.29.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=32dd37c6-9fa5-11ec-a6e9-002590c82437
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 824F 0
277 B 125ms
50ms Image
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 09 Mar 2022 12:34:00 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2 200 bidder_18.html Show response
cache.betweendigital.com/code/ Frame D459 4 KB
1 KB 280ms
56ms Document
text/html 151.236.71.19
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=1f9c724b-53f5-5144-b20a-5e68d022c0dd&CACHEBUSTER=896598
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.71.19 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 0efe00c23297e5c56485eabb6ea548c2669b896704fcb2c426d898148543ccad

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.betweendigital.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: text/html
last-modified: Tue, 08 Jun 2021 15:45:03 GMT
etag: W/"60bf907f-ee9"
content-encoding: gzip
x-cdn-edge-cache: HIT
x-cdn-edge-id: 312
x-cdn-request-id: bc0e1cca0ce940957fce3771a12f075d

GET
DATA 200
OK truncated
/ Frame EF38 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 6ba46222-98e5-4599-8044-501e8063f1e1 Show response
https://s0.2mdn.net/ Frame 7950 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://s0.2mdn.net/6ba46222-98e5-4599-8044-501e8063f1e1
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.f67bd37d6ec09b84b344.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Content-Length: 668

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 95FA 5 KB
6 KB 643ms
58ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=5179457&p=156191&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 96d389a5d3d4e9966b5a823dd0848a29f9e7e8681c18985148edac7e7e3a721e

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:00 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E891 0
731 B 55ms
55ms Script
text/html 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:00 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 46f5a2ee-bff8-4f38-9ed1-c20dcc30ef87
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D540 42 B
64 B 89ms
88ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst3tJmV7JKHmPybAT3Vu4I5Qa1O6TbH2Q6tTTPO3nBpJ_2_NI4FObEhAGYMagGwU7JfZVgDkUilD5LoQlCFHkteLp1K1F15ynvjMRzTb5-QarV__dTd3Q&sai=AMfl-YSNDkjTHaClxB0V_J2oqa-s8Qvm1B8s3323xXR00K_I8BuEjEFpj-_sKRYQXsB6jetO6bZvADUEgPPv57zEW4823XcJzixfBYReHdY3x8iNk_3__cQ6AD4pUeQt154&sig=Cg0ArKJSzD0_ZTkuNV6wEAE&cid=CAASJ-RovyK6ucM1KxNeHbloRSdz_2ULR2Lvv4o6bUWSahfg8ro3mQEjBg&id=lidar2&mcvt=1020&p=990,650,1240,950&mtos=0,1020,1020,1020,1020&tos=0,1020,0,0,0&v=20220307&bin=7&avms=nio&bs=0,0&mc=0.84&if=1&app=0&itpl=20&adk=486039185&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646829241897&rpt=564&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame A4C8 32 KB
10 KB 56ms
55ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: a8377a9082c8d825d0b0201d27c3c2c87638da830ac18482477240dfecff6baf

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:00 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=29291
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9536
Expires: Wed, 09 Mar 2022 20:42:11 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame EF38 5 KB
6 KB 140ms
51ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F60d9856aba44c608c0c45b2c%2F4455976e-1640-4382-9c81-b3d5f7b19a78.woff&t=%20%27-ALMOSbcdeghilnoprstu%C3%B6
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9507312078034042880/DE_makeover_garden_2022_mid_funnel_balkon_300x250_html5_banner-637816440224682097-eafd3144-dede-4075-880f-d9e591f29371.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e0558dad0224a2c667a602460665763c531c01b84a495ad518eeec6f9ef539e

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: HIT
last-modified: Tue, 01 Mar 2022 16:51:07 GMT
server: cloudflare
age: 675774
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=4455976e-1640-4382-9c81-b3d5f7b19a78-subset.woff
cf-ray: 6e93d7a4c9d48892-LHR
expires: Wed, 01 Mar 2023 16:51:07 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 57F7 42 B
64 B 90ms
89ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvsSBbTqT7aoKmQ-2J6_PsNbFDH3pBqW4V7Xqy11F6UQ5iJMTixljeqJUBoiV5nzHwCZXpxlSL3kFDuZqGi6SR0wLxcfgVo2Fc1jS7Z64Pw_ARanG7BA&sai=AMfl-YTJzfZ9jkZeVbWyXlVw5VNrNBjztOcWJxMmJp8ZR0WtKtr5F86voW8x2bHcxfOGGWh3IZnGcm6fJEZmrolzJgXwQbSglZSkmEVGTGwcemkTqDGm8bUBvqgaauNyEHI&sig=Cg0ArKJSzOf71MoYkttAEAE&cid=CAASJ-Ro3feSHVlUChD7ezeI0wkN4ZXQ2dbOHsfy7HvKNarhJ4MXPMaPPA&id=lidar2&mcvt=1026&p=178,650,428,950&mtos=1026,1026,1026,1026,1026&tos=1026,0,0,0,0&v=20220307&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2508741518&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646829241892&rpt=617&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://0191722e3fe80e4aabe920d7bd27fdea.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 9725 1 KB
3 KB 255ms
76ms Document
text/html 2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0e5f7464863960b9e04ccd53d9bcec85b21dfb597c2541f5919fdfaf229e9a70

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://js-sec.indexww.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 230|39|241|46|41|130|196|65
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Wed, 09 Mar 2022 12:34:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 1485
Connection: keep-alive

GET
H2

200

setuid
px.ads.linkedin.com/ Frame A4C8
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0JJLVUQ-1Q-L0E3

0
706 B

328ms
207ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0JJLVUQ-1Q-L0E3
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: F5205951324B4011BFF8746FB88E0E24 Ref B: FRAEDGE0711 Ref C: 2022-03-09T12:34:01Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXZyE/1fnUlhNZJwGA34g==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0JJLVUQ-1Q-L0E3
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame A4C8 70 B
265 B 177ms
56ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame A4C8
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=EQfkPWHuQweK4VM9sDl_2w&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EQfkPWHuQweK4VM9sDl_2w

43 B
556 B

132ms
132ms

Image
image/gif

54.239.38.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EQfkPWHuQweK4VM9sDl_2w

Protocol

HTTP/1.1

Server

54.239.38.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: CAM5N9V3474ZJ4A5EK9S
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=EQfkPWHuQweK4VM9sDl_2w
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame A4C8
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/R8l8wPPnooBecDTyKT_LeMn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5359848801971882287

0
239 B

173ms
57ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5359848801971882287
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Content-Type: image/gif

Redirect headers

date: Wed, 09 Mar 2022 12:34:01 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5359848801971882287
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A4C8
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTk2MjM2NTZjOGIzOWExZjZjNDliMDJlODRhZjFjNWJjYmUwOTEyNA

170 B
188 B

84ms
83ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTk2MjM2NTZjOGIzOWExZjZjNDliMDJlODRhZjFjNWJjYmUwOTEyNA

Protocol

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTk2MjM2NTZjOGIzOWExZjZjNDliMDJlODRhZjFjNWJjYmUwOTEyNA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

v1
ads.yahoo.com/cms/ Frame A4C8
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0JJLVUQ-1Q-L0E3&sigv=1&esig=2~e4e238f65e3d23b6519c877a7b684b5bf7ee22f6

0
194 B

194ms
61ms

Image
text/plain

2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0JJLVUQ-1Q-L0E3&sigv=1&esig=2~e4e238f65e3d23b6519c877a7b684b5bf7ee22f6

Protocol

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0JJLVUQ-1Q-L0E3&sigv=1&esig=2~e4e238f65e3d23b6519c877a7b684b5bf7ee22f6
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 451 709414.gif
id.rlcdn.com/ Frame A4C8 0
0 198ms
63ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A4C8
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=LrgtmF9YTn6LvmvXflbKEQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=LrgtmF9YTn6LvmvXflbKEQ

43 B
556 B

143ms
142ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=LrgtmF9YTn6LvmvXflbKEQ

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: WK69G4N2XSJ8FTRFB72H
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=LrgtmF9YTn6LvmvXflbKEQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame D459
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=db4dc06a-5af5-4a53-8d62-c6add12222fd&ssp=between&gdpr=&gdpr_consent=

43 B
324 B

205ms
62ms

Image
image/gif

34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=db4dc06a-5af5-4a53-8d62-c6add12222fd&ssp=between&gdpr=&gdpr_consent=
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-iframe
Protocol: H2
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=db4dc06a-5af5-4a53-8d62-c6add12222fd&ssp=between&gdpr=&gdpr_consent=
Date: Wed, 09 Mar 2022 12:34:01 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame AE95 54 KB
54 KB 53ms
53ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fhome24%2F60d98659b53a0dc91abcaef0%2Fimages%2F19479e96-57d6-4aee-9cbe-646116533f37.jpg&w=604&h=375&q=85&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2a9dcfa396d4e8cb93ce7f9459d5009ac20a13ebba1992ff644c0ef06b9222a

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: HIT
last-modified: Wed, 09 Mar 2022 09:44:11 GMT
api-supported-versions: 2.0
age: 10190
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 6e93d7a58ed77779-LHR
content-length: 55220
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame AE95 32 KB
32 KB 58ms
58ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fhome24%2F60d98659b53a0dc91abcaef0%2Fimages%2F848959bd-cbaf-41df-ab2b-b155c340d47b.png&w=604&h=374&q=85&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49279c73af883338f2d07b879b400ba5dca2962971f10c6de6a9312c0405d787

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: HIT
last-modified: Wed, 09 Mar 2022 05:10:53 GMT
api-supported-versions: 2.0
age: 26588
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 6e93d7a58ed97779-LHR
content-length: 32324
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame AE95 2 KB
2 KB 55ms
55ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fhome24%2F60d98659b53a0dc91abcaef0%2Fimages%2F7f8ebdec-1691-47e3-ad60-cf6af5131345.png&w=116&h=47&q=85&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94a3b6c0edef64e3766635aa2be8ded354298f67db154296e9bd2bc79f4fa418

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: HIT
last-modified: Tue, 08 Mar 2022 16:58:31 GMT
api-supported-versions: 2.0
age: 70530
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 6e93d7a59eed7779-LHR
content-length: 2272
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame C59A 6 KB
6 KB 59ms
59ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fhome24%2F60d98659b53a0dc91abcaef0%2Fimages%2F0042982a-876f-4f7c-8539-77e0e9a6e4a2.png&w=217&h=130&q=90&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af2e400fa535fa92273f43f56ac7b226a710f0f10facc3f2962a79c8cb10b394

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: HIT
last-modified: Tue, 08 Mar 2022 17:00:29 GMT
api-supported-versions: 2.0
age: 70412
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 6e93d7a5af0c7779-LHR
content-length: 6208
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

POST
H2 200 60d98659b53a0dc91abcaef0
c.bannerflow.net/tr/v2/pixel/ Frame EF38 0
162 B 68ms
68ms Ping
text/plain 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/60d98659b53a0dc91abcaef0
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/621cafa7242430397e02cb4b?did=5ced17d285b1c200019c3fe1&deeplink=on&&redirecturl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssg5dPHXvybqifOa7bWxM5H7NkXEcL6-m2dJvuxnFFDxtSGMDSoZUZ-h5r-9dHhi5ScB-XFP6sM8rJBJqfSVifLPSfQ8zpnUSR6-q0EFF2DU95gx_fPHBJdb1efsEcNE69osxSHFoij0vPMJB9NwYXaLcb4sdb3mq3PUi5lVzH_x7EwQn3s4ZgVD-Nw-vtsMDFrMRtsD9PKHi6-PL-1oBNnfGqYKA0frmWvMszZkNIWEQqOTLhp5o7f7Tvl5oapA-2gLtPK1FqDFhgmgzz1DSedMOxuWxaQBf0tjg4_mMJXCnwoMl7C-flrNH_dkUZhceC31ggq_U8efbCLDYi07HlCDwAIcYgL8MLFDEsQde8IHUSFCXn1ywXH1kmPBdr80MJ_uEEaiJL6M1frQCACXZPGiXwyXhBUAJFFaa1zk2L9wqHAwFTSZOSynngjnx3j8fblNEEvE3N9KiLjf5NJEqIKUiMK-lJwA2QWTpE9O_GyNNahb6tR3fb7Nt2gReEboAzS95eJbFXwQza-msRJWQGleCDqMKPGitemrGyKJ5wfdoodzV-PEFXovyOuVXFNrZ3Grxwl_z5Qpaw0ObCs7bbItnbBmzFnC8jO0rgVm3YMSv9xctE_wcY1Y7msVW-bkfBheNSLL2D3LCG2-juo-fTnhe_Nf-8-tRCKaQQHe3CzpeD7EgbroN2vCoY_SRv0ADdBZLjE4bAlMZswmvvipU66R8MrL6SuP7HUEzXdhXn8s-Yxl9owvyfh7dRmOm2uQq64WMh-qJQyC81NSWccYqxXmqshGoXvMu-lyGXHmiq8X3zkQWMSV_BWITHfTkPNOr0soZjxewCXhdLGRWPYn8XR2cAkkpnzxuwDTkazJKJFyhiarGMQfnp62EwCQmJUaXHQYefSKdg6FWZOSNc7aUoiZclWI3ZM8nfKnqvkKfYu14G3lfEk0CoH_B677qsPsvIu47TPOgy4HQTXYJd3-nj7Gr7MVz27_sQmR3JssNn3vng8sFsahATDSVpK0cfLil6y-Duv1crhs6EDUJ7rzAoyywuAfGI1HVuwqFt8NBpZjWr9irVVde7a5wDSdJ-K76HeDqHFD1aM1w6ua4AyF08pyNuRBY4BYPsuxfaP_-2SuDjHp9znnHUx3ISpecQpwjC3ccEgllCHYwD7cCdPJSY0iVpDzTe4QZskxWMaJ7cdEefRNW2qpUiUJr-WM06ij0nzpr2QWZkWWba787BOL03Q44-JIK_2lHU%26sai%3DAMfl-YRGfldbz1T8Km_wWt3P6DKo6KgcQRfFOpTzLnN7oqh5IW2jwzE2vurVKYTfIYf0Pe9xcX__QDBC0DTJiUhsFvTDSdwePLZBAD-UG7KbDkVJQq4U_C5So50Ri9XbVGeu9pfu_-LTzBaaNusE4sKUvPCBJg7y0rM3CI8c4GpR8X78jsP8JGzFQ75aOH5jCQ0XWaojlCf5Hd_uGrV7XDHG7Rr9KPlxS7FVFxYsshCRwA%26sig%3DCg0ArKJSzNP1779_4A3xEAE%26cry%3D1%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26rm_eid%3D7804798%26adurl%3Dhttps%253A%252F%252Fwww.home24.de%252Ftv-werbespot%252F%253Fdclid%253D%2525edclid!
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s0.2mdn.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6e93d7a60fcb7779-LHR
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 9725 170 B
188 B 83ms
82ms Image
image/png 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YiieuFACwSnGLH2zV9TZ8wAAASsAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-31-243-45.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 9725 70 B
264 B 57ms
56ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 9725
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YiieuFACwSnGLH2zV9TZ8wAAASsAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YiieuFACwSnGLH2zV9TZ8wAAASsAAAIB&dcc=t

43 B
645 B

140ms
139ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YiieuFACwSnGLH2zV9TZ8wAAASsAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 72RS7Q2HQP54RDXTE1C3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 2ZP3SYP7SEJ69X74CEQH
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YiieuFACwSnGLH2zV9TZ8wAAASsAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
secure.adnxs.com/ Frame 9725 0
0 235ms
120ms Image
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

GET
H/1.1 200
OK bridge
cm.adgrx.com/ Frame 9725 43 B
408 B 790ms
179ms Image
image/gif 216.52.31.49

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.52.31.49 -, , ASN (),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
server: Cowboy
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
X-RealServer-NX: sjc-delivery-8
Content-Length: 43
Expires: Thu, 23 Sep 2004 17:42:04 GMT

GET
H/1.1 200
OK ie
match.prod.bidr.io/cookie-sync/ Frame 9725 43 B
430 B 223ms
54ms Image
image/gif 52.31.243.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/ie?gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.243.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 9725
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

43 B
315 B

71ms
70ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:01 GMT

Redirect headers

date: Wed, 09 Mar 2022 12:34:01 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame 9725
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1&gdpr=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1646915641&gdpr=1

43 B
315 B

266ms
67ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1646915641&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:34:01 GMT

Redirect headers

location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1646915641&gdpr=1
pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
content-length: 0
expires: 0

GET
H/1.1 200
OK htw-pixel.gif
js-sec.indexww.com/ht/ Frame 9725 43 B
425 B 56ms
55ms Image
image/gif 2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://js-sec.indexww.com/ht/htw-pixel.gif?YiieuFACwSnGLH2zV9TZ8wAA%26299
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.gismeteo.ua%2F&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Last-Modified: Tue, 24 Jan 2017 19:36:04 GMT
Server: Apache
ETag: "da1f1d-2b-546dc3a097100"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=1016
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Mar 2022 12:50:57 GMT

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame 985A
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=YB5CxkZfEvIN3OD2lfYs&pi=admatic&tc=1

0
407 B

572ms
113ms

Document
text/plain

23.227.139.243

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=YB5CxkZfEvIN3OD2lfYs&pi=admatic&tc=1
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 0
Etag: f7fa5d7958ef4160

Redirect headers

date: Wed, 09 Mar 2022 12:34:01 GMT Wed, 09 Mar 2022 12:34:01 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=YB5CxkZfEvIN3OD2lfYs&pi=admatic&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame 2B97 0
397 B 675ms
112ms Document
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=502624&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 0
Etag: f7fa5d7958ef4160

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame C855 0
397 B 674ms
113ms Document
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=544989&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 0
Etag: f7fa5d7958ef4160

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame F261 0
397 B 674ms
113ms Document
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=550214&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 0
Etag: f7fa5d7958ef4160

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9725 15 KB
6 KB 58ms
57ms Document
text/html 2.21.141.175
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.175 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-175.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=153117
expires: Fri, 11 Mar 2022 07:05:58 GMT
date: Wed, 09 Mar 2022 12:34:01 GMT
vary: Accept-Encoding

GET
H2 200 pbsync.html Show response
js.adscale.de/ Frame EF2F 3 KB
2 KB 177ms
52ms Document
text/html 2600:9000:224a:e00:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:e00:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c82fab08e93db8934a27f5b26ddf48c8a013a92a21ea15b7fa8b675b0d866040

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

content-type: text/html
last-modified: Tue, 08 Mar 2022 15:47:17 GMT
x-amz-version-id: lc33hjxT6dOn57IQAAMXvfX6K.AFf3VD
server: AmazonS3
content-encoding: br
date: Wed, 09 Mar 2022 11:47:27 GMT
cache-control: max-age=7200
etag: W/"9f4e83cc82a56a2a6e9851eeee2f9f34"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: J_YNWQWifYC8IZnygw_Yq0A5emdtcXNBqYDP16KOjyOnfdEtV_Bh-Q==
age: 2795

GET
H2 200 cookie Show response
cm.adform.net/ Frame F06A 43 B
106 B 251ms
76ms Document
image/gif 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame 684E 0
397 B 669ms
113ms Document
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=550070&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Length: 0
Etag: f7fa5d7958ef4160

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame C2B0 0
397 B 673ms
114ms Image
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=306708&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: VertaMedia 1.0
Etag: f7fa5d7958ef4160
Content-Length: 0

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame C2B0 43 B
331 B 785ms
112ms Image
image/gif 23.227.139.243

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?redir=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=712122
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: VertaMedia 1.0
Etag: f7fa5d7958ef4160
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

/
sync3.sniperlog.ru/ Frame D459
Redirect Chain

https://sync.bumlam.com/?src=aid0
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABi5vaKRBlIFl4XSlAY*
https://sync.bumlam.com/?src=aid0&s_data=CAIQABi5vaKRBqIBEDLdN8afpRHspukAJZDIJDc*
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=32dd37c6-9fa5-11ec-a6e9-002590c82437
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=32dd37c6-9fa5-11ec-a6e9-002590c82437&bounce=1
https://sync.bumlam.com/?src=aid1&uid=3dXPVXtCy2fvc8yJ8icyng&
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=3dXPVXtCy2fvc8yJ8icyng&extra2=aidata
https://sync3.sniperlog.ru/?src=ggl&extra1=3dXPVXtCy2fvc8yJ8icyng&extra2=aidata&google_gid=CAESELu6eKRkGe7yO7sbP_ckhZE&google_cver=1

43 B
516 B

251ms
53ms

Image
image/gif

31.172.81.160
DE-FIRSTCOLO www....

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync3.sniperlog.ru/?src=ggl&extra1=3dXPVXtCy2fvc8yJ8icyng&extra2=aidata&google_gid=CAESELu6eKRkGe7yO7sbP_ckhZE&google_cver=1
Protocol: HTTP/1.1
Server: 31.172.81.160 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:02 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync3.sniperlog.ru/?src=ggl&extra1=3dXPVXtCy2fvc8yJ8icyng&extra2=aidata&google_gid=CAESELu6eKRkGe7yO7sbP_ckhZE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 345
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

uu Show response
ih.adscale.de/ Frame EF2F
Redirect Chain

https://ih.adscale.de/uu?cbfn=receive&t=1646829244
https://ih.adscale.de/uu?cbfn=receive&t=1646829244&nut&uu=b0426dc1183246098bf38093b4952cfc

44 B
213 B

56ms
55ms

Script
text/javascript

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/uu?cbfn=receive&t=1646829244&nut&uu=b0426dc1183246098bf38093b4952cfc
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: bdd7deeda9daead34a3d17e576efb39596dcb4ca4df9a1dbf6a477238738b285

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
content-length: 44
content-type: text/javascript;charset=ISO-8859-1

Redirect headers

location: https://ih.adscale.de/uu?cbfn=receive&t=1646829244&nut&uu=b0426dc1183246098bf38093b4952cfc
date: Wed, 09 Mar 2022 12:34:01 GMT
content-length: 0

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 6252
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5

35 B
467 B

74ms
73ms

Document
image/gif

37.157.6.242
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.242 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E4C7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:8ee96228-9eb9-4f00-961f-43a405ed528b&gdpr=0&gdpr_consent=

42 B
341 B

59ms
58ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:8ee96228-9eb9-4f00-961f-43a405ed528b&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug014:0:479
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4245 b916d47 master zrh-pixel-x15 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:8ee96228-9eb9-4f00-961f-43a405ed528b&gdpr=0&gdpr_consent=
Expires: Wed, 09 Mar 2022 12:34:00 GMT

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 620C
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3327525152331367318

42 B
210 B

278ms
58ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3327525152331367318
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug014:0:422
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3327525152331367318
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 8767
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
111 B

58ms
57ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug030:0:344
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

date: Wed, 09 Mar 2022 12:34:00 GMT
server: Kestrel
content-length: 0
cache-control: no-cache
pragma: no-cache
expires: Wed, 09 Mar 2022 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1514878
strict-transport-security: max-age=31536000; preload;

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7A9B
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7073077732208146577

42 B
210 B

141ms
59ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7073077732208146577
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug017:0:441
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Server: nginx
Date: Wed, 09 Mar 2022 12:34:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7073077732208146577

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B6FF
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YiieuQAL2uGzCQBH&gdpr=0&gdpr_consent=&_test=YiieuQAL2uGzCQBH

1 B
235 B

58ms
57ms

Document
text/html

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YiieuQAL2uGzCQBH&gdpr=0&gdpr_consent=&_test=YiieuQAL2uGzCQBH
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: lhrpug010:0:520
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YiieuQAL2uGzCQBH&gdpr=0&gdpr_consent=&_test=YiieuQAL2uGzCQBH
accept-ranges: bytes
date: Wed, 09 Mar 2022 12:34:01 GMT
via: 1.1 varnish
x-served-by: cache-hhn4083-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1646829242.905019,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7464
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=9ZybpAnJSZpvWig6Vj6VSlLHgik

42 B
220 B

58ms
58ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=9ZybpAnJSZpvWig6Vj6VSlLHgik
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug007:0:833
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Wed, 09 Mar 2022 12:34:02 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=9ZybpAnJSZpvWig6Vj6VSlLHgik
Content-Length: 159
Connection: keep-alive

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D315
Redirect Chain

https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0

0
88 B

118ms
60ms

Document
text/html

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: text/html; charset=utf-8
x-lat: lhrpug029:2:411
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private
content-encoding: gzip

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
content-length: 0
date: Wed, 09 Mar 2022 12:34:01 GMT
server: _

GET
H/1.1

200
OK

adx Show response
match.prod.bidr.io/cookie-sync/ Frame C86D
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFIWXZrN0VVVDBBQUN1SWhWOGN4QQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

43 B
430 B

54ms
54ms

Document
image/gif

52.31.243.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.243.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-243-45.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, must-revalidate
content-type: image/gif
Date: Wed, 09 Mar 2022 12:34:01 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 43
Connection: keep-alive

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date: Wed, 09 Mar 2022 12:34:01 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 355
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame DCAE 0
0 364ms
117ms Document
text/plain 5.161.54.172

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

5.161.54.172 -, , ASN (),

Reverse DNS

Software

nginx/1.21.4 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: nginx/1.21.4
Date: Wed, 09 Mar 2022 12:34:01 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15768000

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 086C
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
446 B

217ms
209ms

Document
image/gif

2606:4700::6812:d05

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6e93d7aa5a1e779d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 206
x-reuse-index: 86
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6e93d7a8cf02779d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK bridge Show response
cm.adgrx.com/ Frame 9A0F 43 B
408 B 354ms
179ms Document
image/gif 216.52.31.49

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.52.31.49 -, , ASN (),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
server: Cowboy
X-RealServer-NX: sjc-delivery-8
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 6A50 43 B
279 B 317ms
80ms Document
image/gif 195.5.165.20

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Vary: Accept-Encoding
X-adserver-worker: avatar-6eed3572d2cf@version_1.382v3
Connection: close
X-server-arch: v2
Content-Type: image/gif
Content-Length: 43
X-core-time: 0ms
Date: Wed, 09 Mar 2022 12:34:01 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E505
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/pubmatic?zcc=1&cb=1646829241767
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5965440734
https://sync.1rx.io/usersync/tradedesk/68a64bb7-77e8-4dc3-b032-c01f2cc3c6de
https://sync.targeting.unrulymedia.com/csync/RX-afe7ba05-1c19-42bd-8e64-d134d0d1d758-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-afe7ba05-1c19-42bd-8e64-d134d0d1d758-003

42 B
228 B

59ms
59ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-afe7ba05-1c19-42bd-8e64-d134d0d1d758-003
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Wed, 09 Mar 2022 12:34:02 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug024:0:2057
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Tengine
date: Wed, 09 Mar 2022 12:34:02 GMT
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-afe7ba05-1c19-42bd-8e64-d134d0d1d758-003
etag: RXafe7ba051c1942bd8e64d134d0d1d758003

GET
H2 404 dpe Show response
ad4m.at/ad/ Frame 5469 15 B
891 B 166ms
62ms Document
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6420ab9ec6ebff1cd61333dade6ba9ac879d3617a59334148672dee6af12fec

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
content-type: text/plain; charset=utf-8
content-length: 15
report-to: {"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires: 0
cache-control: max-age=43200, must-revalidate, proxy-revalidate
content-security-policy: block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy: same-origin
pragma: no-cache
surrogate-control: no-store
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: HIT
age: 687354
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 6e93d7a8cd9e750d-LHR

GET

rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame F16F
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c8bcdac0-6667-4cda-acc1-d5e5e6c894da-tuct922243a&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 95FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sfEJ9V6STeGF9vhgTcL5xQ%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

12 KB
12 KB

59ms
59ms

Image
text/html

2.21.141.175
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 2.21.141.175 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-175.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=153117
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Fri, 11 Mar 2022 07:05:58 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

SPug
image4.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=05b16228-9eb9-4400-8019-99d3aea2355a

0
0

GET

/
spl.zeotap.com/ Frame 95FA
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=44ac28f6d3b70a994f4f28e1d03aac6e
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
https://pixel.onaudience.com/?partner=147&mapped=68a64bb7-77e8-4dc3-b032-c01f2cc3c6de&icm
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/gdpr=/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD/gdpr=/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=1334823f757c648cfc9cce13d9b27622&gdpr=
https://spl.zeotap.com/?zdid=1332&zcluid=fe0b3acf2ec64070

0
0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjFGMTA5RjUtNUU5Mi00REUxLTg1RjYtRjg2MDREQzJGOUM1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
110 B

475ms
59ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug027:0:740
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJhnnstPvQVo_DrqhoMh4_4&google_cver=1

42 B
436 B

474ms
57ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJhnnstPvQVo_DrqhoMh4_4&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug012:0:345
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJhnnstPvQVo_DrqhoMh4_4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 95FA 43 B
612 B 182ms
59ms Image
image/gif 169.50.137.184
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

169.50.137.184 , United States, ASN36351 (SOFTLAYER, US),

Reverse DNS

b8.89.32a9.ip4.static.sl-reverse.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Tue, 08 Mar 2022 12:34:01 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3496706914112175395

42 B
233 B

58ms
58ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3496706914112175395
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug008:0:418
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3496706914112175395
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=68a64bb7-77e8-4dc3-b032-c01f2cc3c6de

42 B
603 B

192ms
58ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=68a64bb7-77e8-4dc3-b032-c01f2cc3c6de
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:495
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=68a64bb7-77e8-4dc3-b032-c01f2cc3c6de
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3292147739517443581&gdpr=0&gdpr_consent=

42 B
233 B

488ms
59ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3292147739517443581&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug019:0:703
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:01 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 288a02e2-c83e-4489-8cfc-fe291f2a7471
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3292147739517443581&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=AS98EA54LBEaLngQUntjGgIkex0aLC8fUiuaZrwa

42 B
310 B

494ms
58ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=AS98EA54LBEaLngQUntjGgIkex0aLC8fUiuaZrwa
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug018:0:507
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=AS98EA54LBEaLngQUntjGgIkex0aLC8fUiuaZrwa
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 95FA 43 B
990 B 92ms
61ms Image
image/gif 2a05:d018:d29:3601:b73:5e1d:a8b6:5551
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:b73:5e1d:a8b6:5551 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET

SPug
image4.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-YrUrWW5E2uXmBlfBDtOctIuMlBNHlmc-~A&gdpr=0&gdpr_consent=

0
0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=db4dc06a-5af5-4a53-8d62-c6add12222fd
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=db4dc06a-5af5-4a53-8d62-c6add12222fd
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=55379f0e-7ab2-4f3e-96c0-8b96a52d73cf&user_group=1&ssp=pubmatic&bsw_param=db4dc06a-5af5-4a53-8d62-c6add12222fd
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&gdpr_consent=&gdpr_pd=

1 B
181 B

58ms
58ms

Image
text/html

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:556
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=db4dc06a-5af5-4a53-8d62-c6add12222fd&gdpr=&gdpr_consent=&gdpr_pd=
Date: Wed, 09 Mar 2022 12:34:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8040012551122540478&gdpr=0&gdpr_consent=&us_privacy=

1 B
186 B

93ms
59ms

Image
text/html

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8040012551122540478&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:629
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8040012551122540478&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:0463bd9d-34ce-405d-864f-42937d054f72&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
110 B

151ms
59ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:0463bd9d-34ce-405d-864f-42937d054f72&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug021:0:419
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:0463bd9d-34ce-405d-864f-42937d054f72&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 95FA 0
103 B 77ms
48ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=B1F109F5-5E92-4DE1-85F6-F8604DC2F9C5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3292147739517443581

42 B
110 B

58ms
57ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3292147739517443581
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug028:0:362
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Wed, 09 Mar 2022 12:34:02 GMT
X-Proxy-Origin: 82.199.130.41; 82.199.130.41; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e7fd46c8-3b24-4da3-bc24-5c3570ab5a81
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3292147739517443581
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 95FA
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=19838689-0a8d-4241-a26f-2b930b575eab-62289eb9-4348&gdpr=0&gdpr_consent=

42 B
232 B

58ms
58ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=19838689-0a8d-4241-a26f-2b930b575eab-62289eb9-4348&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:02 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug012:0:660
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 09 Mar 2022 12:34:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=19838689-0a8d-4241-a26f-2b930b575eab-62289eb9-4348&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 userconnect.js Show response
js.adscale.de/ Frame EF2F 11 KB
4 KB 52ms
51ms Script
application/javascript 2600:9000:224a:e00:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/userconnect.js
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:e00:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca38ab561201a1a68867f61d4fb3df9682756c8927fe80f047624e7ef662f0f3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

x-amz-version-id: IbLf1gFTqkULTn0ziZS5PGWDI8WFsfyJ
content-encoding: br
last-modified: Tue, 08 Mar 2022 15:47:17 GMT
server: AmazonS3
age: 2796
etag: W/"988fbfb6c270a6080f89deb043243858"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Wed, 09 Mar 2022 11:47:26 GMT
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: zJZDWDQt93OQVAkseRZBtfvORaDms3LUNmCbNdEdUfUt_deJPrgQ7A==

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame EF2F 0
419 B 350ms
112ms Image
text/plain 23.227.139.243

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307565&extuid=b0426dc1183246098bf38093b4952cfc
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 23.227.139.243 -, , ASN (),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date: Wed, 09 Mar 2022 12:34:01 GMT
Server: VertaMedia 1.0
Etag: bfbea922324daf04
Content-Length: 0

GET
H2 200 userconnect Show response
ih.adscale.de/ Frame EF2F 149 B
224 B 56ms
56ms Script
application/javascript 54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/userconnect?ssl=1&sid=0&cbfn=stroeerCoreConnect&ts=1646829244421&umd=false&gdpr=0&gdpr_version=2&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date: Wed, 09 Mar 2022 12:34:01 GMT
content-length: 149
content-type: application/javascript

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E891 0
731 B 109ms
109ms Script
text/html 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS