glossy.espreso.co.rs Open in urlscan Pro
185.80.68.6 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://glossy.espreso.rs/
Effective URL:
https://glossy.espreso.co.rs/
Submission Tags: falconsandbox
Submission: On April 26 via api (April 26th 2021, 1:23:00 pm UTC) from US

Summary HTTP 146 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 35 IPs in 7 countries across 27 domains to perform 146 HTTP transactions. The main IP is 185.80.68.6, located in Serbia and belongs to PROVIDUS-AS, RS. The main domain is glossy.espreso.co.rs.
TLS certificate: Issued by R3 on March 29th 2021. Valid for: 3 months.

This is the only time glossy.espreso.co.rs was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	185.80.68.6 185.80.68.6	43191 (PROVIDUS-AS) (PROVIDUS-AS)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
2 4	54.38.63.93 54.38.63.93	16276 (OVH) (OVH)
4	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:f1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:20c... 2600:9000:20c8:9c00:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
4	87.237.206.234 87.237.206.234	51859 (MNSHA-AS) (MNSHA-AS)
3	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2 5	87.237.206.235 87.237.206.235	51859 (MNSHA-AS) (MNSHA-AS)
2	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20c... 2600:9000:20c8:f200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3 5	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
1	13.224.193.118 13.224.193.118	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2 4	137.74.0.158 137.74.0.158	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
30	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
7	51.159.89.0 51.159.89.0	12876 (Online SAS) (Online SAS)
10	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2006	15169 (GOOGLE) (GOOGLE)
3 4	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2 4	184.30.24.241 184.30.24.241	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.33.221.52 185.33.221.52	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:20c... 2600:9000:20c8:8e00:18:1fcd:34e:d2a1	16509 (AMAZON-02) (AMAZON-02)
1	18.235.239.192 18.235.239.192	14618 (AMAZON-AES) (AMAZON-AES)
146	35

19 185.80.68.6 (Serbia) 1 redirects

ASN43191 (PROVIDUS-AS, RS)

glossy.espreso.rs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
glossy.espreso.co.rs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.38.63.93 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: ip93.ip-54-38-63.eu

rs.adocean.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:f1f (United States)

ASN13335 (CLOUDFLARENET, US)

static.cleverpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20c8:9c00:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 87.237.206.234 (Serbia)

ASN51859 (MNSHA-AS, RS)

gars.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rs.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 87.237.206.235 (Serbia) 2 redirects

ASN51859 (MNSHA-AS, RS)

adrs.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c8:f200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.193.118 (United States)

ASN16509 (AMAZON-02, US)

pym.nprapps.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 137.74.0.158 (Warsaw, Poland) 2 redirects

ASN16276 (OVH, FR)

alt.hudb.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alt.adocean.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 51.159.89.0 (Paris, France)

ASN12876 (Online SAS, FR)

www.kurir.rs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.16.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.30.24.241 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-241.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.52 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c8:8e00:18:1fcd:34e:d2a1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.235.239.192 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	googlesyndication.com fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	429 KB
18	doubleclick.net 3 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net	170 KB
18	espreso.co.rs glossy.espreso.co.rs	571 KB
10	ampproject.org cdn.ampproject.org	215 KB
9	gemius.pl 2 redirects gars.hit.gemius.pl adrs.hit.gemius.pl rs.hit.gemius.pl	13 KB
8	gstatic.com fonts.gstatic.com	245 KB
7	kurir.rs www.kurir.rs	6 MB
6	google.com 3 redirects www.google.com adservice.google.com	670 B
6	adocean.pl 3 redirects rs.adocean.pl alt.adocean.pl	45 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
4	facebook.net connect.facebook.net	163 KB
4	googletagservices.com www.googletagservices.com	119 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	facebook.com www.facebook.com	584 B
3	google-analytics.com www.google-analytics.com	19 KB
2	hudb.pl 1 redirects alt.hudb.pl	627 B
2	google.de www.google.de adservice.google.de	1 KB
2	quantcount.com rules.quantcount.com pixel.quantcount.com	565 B
2	consensu.org quantcast.mgr.consensu.org	78 KB
1	chartbeat.net ping.chartbeat.net	169 B
1	chartbeat.com static.chartbeat.com	14 KB
1	2mdn.net s0.2mdn.net	99 KB
1	nprapps.org pym.nprapps.org	3 KB
1	quantserve.com secure.quantserve.com	9 KB
1	cleverpush.com static.cleverpush.com	90 KB
1	googleapis.com fonts.googleapis.com	714 B
1	espreso.rs 1 redirects glossy.espreso.rs	94 B
146	27

	Domain	Requested by
30	tpc.googlesyndication.com	securepubads.g.doubleclick.net glossy.espreso.co.rs fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com cdn.ampproject.org googleads.g.doubleclick.net tpc.googlesyndication.com
18	glossy.espreso.co.rs	glossy.espreso.co.rs
11	pagead2.googlesyndication.com	fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com securepubads.g.doubleclick.net www.googletagservices.com
10	cdn.ampproject.org	securepubads.g.doubleclick.net
8	fonts.gstatic.com	fonts.googleapis.com
7	www.kurir.rs	pym.nprapps.org www.kurir.rs
6	googleads.g.doubleclick.net	fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com glossy.espreso.co.rs
5	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net glossy.espreso.co.rs
5	www.google.com	3 redirects glossy.espreso.co.rs
5	adrs.hit.gemius.pl	2 redirects rs.adocean.pl
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	connect.facebook.net	glossy.espreso.co.rs connect.facebook.net
4	www.googletagservices.com	glossy.espreso.co.rs securepubads.g.doubleclick.net fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
4	rs.adocean.pl	2 redirects glossy.espreso.co.rs
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.facebook.com	glossy.espreso.co.rs
3	www.google-analytics.com	glossy.espreso.co.rs www.google-analytics.com
3	gars.hit.gemius.pl	glossy.espreso.co.rs gars.hit.gemius.pl
2	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
2	alt.adocean.pl	1 redirects glossy.espreso.co.rs
2	alt.hudb.pl	1 redirects glossy.espreso.co.rs
2	quantcast.mgr.consensu.org	glossy.espreso.co.rs quantcast.mgr.consensu.org
1	ping.chartbeat.net
1	static.chartbeat.com	glossy.espreso.co.rs
1	s0.2mdn.net	fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
1	pixel.quantcount.com	glossy.espreso.co.rs
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	rs.hit.gemius.pl	glossy.espreso.co.rs
1	pym.nprapps.org	glossy.espreso.co.rs
1	www.google.de	glossy.espreso.co.rs
1	rules.quantcount.com	secure.quantserve.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	static.cleverpush.com	glossy.espreso.co.rs
1	fonts.googleapis.com	glossy.espreso.co.rs
1	glossy.espreso.rs	1 redirects
146	39

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.youtube.com
www.instagram.com
stil.kurir.rs
lepaisrecna.mondo.rs
www.lovesensa.rs
www.kurir.rs
www.elle.rs
www.lepaisrecna.rs
www.newsweek.rs
www.nationalgeographic.rs
www.stvarukusa.rs
www.yumama.com
www.wanted.rs
www.espreso.co.rs
www.navidiku.rs

Subject Issuer	Validity	Valid
espreso.co.rs R3	`2021-03-29` - `2021-06-27`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.adocean.pl Sectigo ECC Domain Validation Secure Server CA	`2020-01-27` - `2022-02-05`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-12` - `2021-08-12`	a year	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
*.hit.gemius.pl Sectigo ECC Domain Validation Secure Server CA	`2019-09-11` - `2021-09-24`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
pym.nprapps.org Amazon	`2020-06-04` - `2021-07-04`	a year	crt.sh
*.google.de GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
www.kurir.rs R3	`2021-03-01` - `2021-05-30`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-03-23` - `2021-06-15`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2020-06-01` - `2021-06-02`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2020-12-01` - `2021-12-30`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://glossy.espreso.co.rs/
Frame ID: 43162FC9BCE2E40D40CD0B6D803B0D9D
Requests: 71 HTTP requests in this frame

Frame: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Frame ID: AB019F7097CFD4AEE0CA60DE3726BE83
Requests: 7 HTTP requests in this frame

Frame: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: AD70A7D7D877B84161B5EB12FED7077E
Requests: 14 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs
Frame ID: 7194B26BE394722C8CCA150896C6084D
Requests: 15 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs
Frame ID: B90B17F83E922AC95158D69170B38BDD
Requests: 15 HTTP requests in this frame

Frame: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D851E766F89F9326E83B474C4875E4C1
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg
Frame ID: A2DCE4CB5B7F535FE0F50C3DB254EC1A
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html
Frame ID: A9E4279B1232BC521F37B46CFE4792E4
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E592CDB83C9A91AAFBE3C909F4D4BB50
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 6D1CD2B9F5ACE2AC6AC2F2F6856BF35C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: BF4FF7C5055D725F3DB3CFCDF13BD9CA
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://glossy.espreso.rs/ HTTP 301
https://glossy.espreso.co.rs/ Page URL

Page Statistics

146
Requests

99 %
HTTPS

62 %
IPv6

27
Domains

39
Subdomains

35
IPs

7
Countries

7999 kB
Transfer

10739 kB
Size

7
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/glossy.rs/

Search URL Search Domain Scan URL

URL: https://twitter.com/glossy_rs

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCdyMbH4JckymM38HzUugwsA

Search URL Search Domain Scan URL

URL: https://www.instagram.com/glossy_rs/

Search URL Search Domain Scan URL

URL: https://stil.kurir.rs/lepi-zdravi/fitnes/150181/ubica-celulita-ove-vezbe-ce-vas-osloboditi-narandzine-kore-a-rade-se-samo-10-minuta-dnevno-video

Search URL Search Domain Scan URL

URL: https://stil.kurir.rs/celebrities/150187/hrvatska-misica-vec-4-godine-menja-izgled-u-zelji-da-postane-savrsena-verenik-veruje-u-mene-zna-da-sam-umerena-video

Search URL Search Domain Scan URL

URL: https://stil.kurir.rs/lepi-zdravi/fitnes/150181/ubica-celulita-ove-vezbe-ce-vas-osloboditi-narandzine-kore-a-rade-se-samo-10-minuta-dnevno-video?utm_source=glossy&utm_medium=web_home&utm_campaign=adria_internal

Search URL Search Domain Scan URL

URL: https://lepaisrecna.mondo.rs/Basta/Saveti/a35912/lavanda-bosiljak-ruzmarin.html?utm_source=glossy&utm_medium=web_home&utm_campaign=adria_internal

Search URL Search Domain Scan URL

URL: https://www.lovesensa.rs/clanci/seksualnost/kako-da-poboljsate-vodenje-ljubavi-sa-partnerom-7-tajni-mocne-tantricke-metode?utm_source=glossy&utm_medium=web_home&utm_campaign=adria_internal

Search URL Search Domain Scan URL

URL: https://www.kurir.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.elle.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.lepaisrecna.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.newsweek.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.lovesensa.rs/

Search URL Search Domain Scan URL

URL: http://www.nationalgeographic.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.stvarukusa.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.yumama.com/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: http://www.wanted.rs/?utm_source=glossy&utm_campaign=footer_link&utm_medium=link

Search URL Search Domain Scan URL

URL: https://www.espreso.co.rs/?internal_campaign=glossy_footer_link

Search URL Search Domain Scan URL

URL: https://www.navidiku.rs/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://glossy.espreso.rs/ HTTP 301
https://glossy.espreso.co.rs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://rs.adocean.pl/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F HTTP 301
https://rs.adocean.pl/__/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F HTTP 301
https://adrs.hit.gemius.pl/redataredir?url=https%3A%2F%2Frs.adocean.pl%2F__%2F_1619443360%2Fad.js%3Fhclsdata%3DHCLSDATA%26hcudata%3DHCUDATA%26id%3DJQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7%2Fadov%3D4.2.0%2Fx%3D1600%2Fy%3D1200%2Fpage_url%3Dhttps%253A%252F%252Fglossy.espreso.co.rs%252F HTTP 301
https://adrs.hit.gemius.pl/__/redataredir?url=https%3A%2F%2Frs.adocean.pl%2F__%2F_1619443360%2Fad.js%3Fhclsdata%3DHCLSDATA%26hcudata%3DHCUDATA%26id%3DJQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7%2Fadov%3D4.2.0%2Fx%3D1600%2Fy%3D1200%2Fpage_url%3Dhttps%253A%252F%252Fglossy.espreso.co.rs%252F HTTP 301
https://rs.adocean.pl/__/_1619443360/ad.js?hclsdata=&hcudata=Qqks2FqWpmOoJhUNAbVu4fuwyAIh3NB3ZgKFJf8JuCf.17&id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F

Request Chain 38

https://alt.hudb.pl/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D0 HTTP 301
https://alt.hudb.pl/__/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D0

Request Chain 39

https://alt.adocean.pl/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D1 HTTP 301
https://alt.adocean.pl/__/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D1

Request Chain 101

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 105

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1

Request Chain 121

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YIa.ohdvTjfM2vzhOmkCgwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1&google_hm=2

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEAhvwNZPpLw6KusU9hyH3dA&google_cver=1

Request Chain 123

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU3OTIwOTc5ODQ4Nzg2Nzk5NQ%3D%3D

Request Chain 138

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

146 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
glossy.espreso.co.rs/
Redirect Chain

http://glossy.espreso.rs/
https://glossy.espreso.co.rs/

126 KB
30 KB

160ms
50ms

Document
text/html

185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 00c386d44ee97982b7afa31aa58529acbb575edb8f5d2352f0c7c3dff5597e84

Request headers

:method: GET
:authority: glossy.espreso.co.rs
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:15 GMT
vary: Accept-Encoding
content-encoding: gzip
x-backend-server: glossy-web2 time for request D=11944
content-length: 29964
content-type: text/html; charset=UTF-8
server: Haste
x-haste-cacheable: YES
expires: 0
x-haste-perspective: desktop
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
age: 24
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq4.itplatforma.com
x-haste-cache: HIT
x-haste-hits: 2
accept-ranges: bytes

Redirect headers

content-length: 0
location: https://glossy.espreso.co.rs/

GET
H2 200 css
fonts.googleapis.com/ 5 KB
714 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d05476160b2e6ab3b268c139f71dcd960449aae386a6b7c7ba330f22f3a12de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 26 Apr 2021 12:18:49 GMT
server: ESF
date: Mon, 26 Apr 2021 13:22:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 26 Apr 2021 13:22:40 GMT

GET
H2 200 main-v-16107096751945.js Show response
glossy.espreso.co.rs/resources/js/ 218 KB
66 KB 62ms
61ms Script
application/javascript 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://glossy.espreso.co.rs/resources/js/main-v-16107096751945.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 73543b3da479f12c64d510e6483c68283b8990da5888ac5df4f2cc93c669596b

Request headers

:path: /resources/js/main-v-16107096751945.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:08:46 GMT
content-encoding: gzip
age: 833
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq1.itplatforma.com
x-backend-server: glossy-web1 time for request D=11148
content-length: 66571
x-haste-perspective: desktop
last-modified: Fri, 15 Jan 2021 11:40:43 GMT
server: Haste
etag: "3697e-5b8eed7a976ed-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age = 315360000, public
x-haste-hits: 71
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main-v-16107096751945.css
glossy.espreso.co.rs/resources/css/ 85 KB
16 KB 51ms
50ms Stylesheet
text/css 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://glossy.espreso.co.rs/resources/css/main-v-16107096751945.css
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: d3eee9e4ebf3283e4e03867700f591840bb9f2d23ba4b957589b0f88381d28c9

Request headers

:path: /resources/css/main-v-16107096751945.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:08:46 GMT
content-encoding: gzip
age: 833
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq1.itplatforma.com
x-backend-server: glossy-web2 time for request D=6490
content-length: 15714
x-haste-perspective: desktop
last-modified: Wed, 13 Jan 2021 11:32:19 GMT
server: Haste
etag: "15400-5b8c67dee4b07-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age = 315360000, public
x-haste-hits: 72
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ado.js Show response
rs.adocean.pl/files/js/ 93 KB
32 KB 167ms
53ms Script
application/x-javascript 54.38.63.93
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.adocean.pl/files/js/ado.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.38.63.93 , France, ASN16276 (OVH, FR),
Reverse DNS: ip93.ip-54-38-63.eu
Software: GAD /
Resource Hash: bae2f4a1d2f8daad335303236aa79bf3626c6254ee7d3e0b4cabfd30dd004223

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:40 GMT
content-encoding: gzip
last-modified: Wed, 13 Jan 2021 15:55:43 GMT
server: GAD
etag: "00017272A0BEF214"
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: public, must-revalidate, max-age=14400
accept-ranges: bytes
content-type: application/x-javascript
content-length: 32167
expires: Mon, 26 Apr 2021 17:22:40 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 62 KB
21 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a32de0e80741978e7816c3639f2697f435e1c270c04c755c2367e1c2829a9d84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "853 / 622 of 1000 / last-modified: 1619435468"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21097
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:40 GMT

GET
H2 200 kTvC4RTe5ySLedKnR.js Show response
static.cleverpush.com/channel/loader/ 448 KB
90 KB 40ms
25ms Script
application/javascript 2606:4700:20::681a:f1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cleverpush.com/channel/loader/kTvC4RTe5ySLedKnR.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:f1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b740d8e668dff5a9fbbfa8712482f7176d4679cc1cff5f6c5a83654a062c1f6

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 1668
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: DFDCYJB1QT4B6NF3
x-amz-id-2: b/uTcnCsopbHpfCjvpkbJxVf7XWhGk+NSsOpR5CWdoYSsVliE8DY8bh6sALGRCwWfBNLb3S/A2I=
last-modified: Mon, 26 Apr 2021 00:39:43 GMT
server: cloudflare
etag: W/"7ed5bb38672ea853c08869c5f530ad1a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZB8715zpLatawIDV4jVJbCwTW5RpC5%2FCUb9bbz4rt4GzDN9QQOxt%2BqrJjA8KQlvP5ETeE1IBYpuh5gkkGVW9YKkq8%2FKcowsyVCU829s48esmJ8f8jRQEQ2j%2B%2BD6mPnk3CCY%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript
cache-control: public, max-age=5356800
cf-request-id: 09aff1ba5000004dca05805000000001
cf-ray: 64601f0a1ce54dca-FRA

GET
H2 200 logo.svg
glossy.espreso.co.rs/resources/images/svg/ 5 KB
3 KB 51ms
50ms Image
image/svg+xml 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/resources/images/svg/logo.svg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 047ed5c1bcaea807f1edb61af9be9d808c474d7ae00dd2577067ad4adbcffd29

Request headers

:path: /resources/images/svg/logo.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:38 GMT
content-encoding: gzip
age: 1
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web2 time for request D=1055
content-length: 2249
x-haste-perspective: desktop
last-modified: Wed, 13 Jan 2021 11:32:19 GMT
server: Haste
etag: "14b4-5b8c67dee79e7-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-haste-hits: 1
accept-ranges: bytes
x-haste-cacheable: YES
expires: 0

GET
H2 200 320397_ivana-korab_po-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/12/ 48 KB
49 KB 51ms
50ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/12/320397_ivana-korab_po-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: c4c5ec3f529c6f8f951120a229c1b1cd386dde12e4de0cea91cfabe367e57f36

Request headers

:path: /data/images/2021/04/26/12/320397_ivana-korab_po-s.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:19:58 GMT
age: 161
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq1.itplatforma.com
x-backend-server: glossy-web2 time for request D=1112
content-length: 49303
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 10:36:58 GMT
server: Haste
etag: "c097-5c0ddb9a4e7ef"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 3
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 320395_profimedia06078920331_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/12/ 31 KB
32 KB 54ms
54ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/12/320395_profimedia06078920331_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 6fba8bf2989182b28478f3ac9b3d3cd8ce216c20bd3e1a518a2280eb013aab95

Request headers

:path: /data/images/2021/04/26/12/320395_profimedia06078920331_sq-s.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:15:41 GMT
age: 418
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq2.itplatforma.com
x-backend-server: glossy-web2 time for request D=5128
content-length: 31954
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 10:19:09 GMT
server: Haste
etag: "7cd2-5c0dd79e971ea"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 10
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 276127_profimedia0484703584_sq-s.jpg
glossy.espreso.co.rs/data/images/2019/11/25/13/ 30 KB
30 KB 54ms
50ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2019/11/25/13/276127_profimedia0484703584_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 85516914f05006889ec386568254f3f6793056f54ce0b02c9d5e8fbd137e223f

Request headers

:path: /data/images/2019/11/25/13/276127_profimedia0484703584_sq-s.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:16:44 GMT
age: 355
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq2.itplatforma.com
x-backend-server: glossy-web2 time for request D=2116
content-length: 30299
x-haste-perspective: desktop
last-modified: Mon, 25 Nov 2019 12:20:32 GMT
server: Haste
etag: "765b-5982aca3f2439"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 15
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 lazy.png
glossy.espreso.co.rs/resources/images/ 936 B
1 KB 52ms
51ms Image
image/png 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/resources/images/lazy.png
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 8c5a62c74692dd5d707767c763842fa3a199c5d50b526f2a138747af21ba6202

Request headers

:path: /resources/images/lazy.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:16:00 GMT
age: 400
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq2.itplatforma.com
x-backend-server: glossy-web1 time for request D=313
content-length: 936
x-haste-perspective: desktop
last-modified: Wed, 13 Jan 2021 11:32:19 GMT
server: Haste
etag: "3a8-5b8c67dee6a47"
content-type: image/png
cache-control: max-age = 315360000, public
x-haste-hits: 36
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/pLW1P-3X_Ppr5/www.espreso.co.rs/ 3 KB
2 KB 144ms
65ms Script
application/javascript 2600:9000:20c8:9c00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/pLW1P-3X_Ppr5/www.espreso.co.rs/choice.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:9c00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86ab03a72e25300a317a6a1e722eb5299b33aeac4d2c8c20ba769328bd90180b

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:40 GMT
content-encoding: gzip
etag: W/"236f223ad4fd36f41f0d3ab46fc5f58d"
last-modified: Wed, 10 Feb 2021 22:07:22 GMT
server: AmazonS3
x-amz-cf-pop: MAD50-C1
x-amz-server-side-encryption: AES256
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3f18bbc133cf4ddae8afcd8a83c77a98.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-id: gn5No42Y2fGOPEv1OJJ4TxM5NIOiOMdqdKKEE6H7uRWWIjhOdH2s7Q==

GET
H2 200 xgemius.js Show response
gars.hit.gemius.pl/ 39 KB
10 KB 206ms
67ms Script
application/x-javascript 87.237.206.234
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://gars.hit.gemius.pl/xgemius.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.234 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: a4096ac8f0fd66170f9e70a2c9739e5e57585491f25b2ba93debde376d7c5b65

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
last-modified: Wed, 17 Mar 2021 11:13:20 GMT
server: GHC
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: max-age=43200
accept-ranges: none
content-type: application/x-javascript
content-length: 10548
expires: Tue, 27 Apr 2021 01:22:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 6128
date: Mon, 26 Apr 2021 11:40:33 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Mon, 26 Apr 2021 13:40:33 GMT

GET
H2

200

ad.js Show response
rs.adocean.pl/__/_1619443360/
Redirect Chain

https://rs.adocean.pl/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
https://rs.adocean.pl/__/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
https://adrs.hit.gemius.pl/redataredir?url=https%3A%2F%2Frs.adocean.pl%2F__%2F_1619443360%2Fad.js%3Fhclsdata%3DHCLSDATA%26hcudata%3DHCUDATA%26id%3DJQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7%2Fa...
https://adrs.hit.gemius.pl/__/redataredir?url=https%3A%2F%2Frs.adocean.pl%2F__%2F_1619443360%2Fad.js%3Fhclsdata%3DHCLSDATA%26hcudata%3DHCUDATA%26id%3DJQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7%...
https://rs.adocean.pl/__/_1619443360/ad.js?hclsdata=&hcudata=Qqks2FqWpmOoJhUNAbVu4fuwyAIh3NB3ZgKFJf8JuCf.17&id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https...

12 KB
13 KB

53ms
53ms

Script
application/x-javascript

54.38.63.93
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.adocean.pl/__/_1619443360/ad.js?hclsdata=&hcudata=Qqks2FqWpmOoJhUNAbVu4fuwyAIh3NB3ZgKFJf8JuCf.17&id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.38.63.93 , France, ASN16276 (OVH, FR),
Reverse DNS: ip93.ip-54-38-63.eu
Software: GAD /
Resource Hash: 331ef5ae0fc9f67d983660c7b39fde19c53be46c167a6fa058f6e42ce3668ea4

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GAD
vary: Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-type: application/x-javascript
content-length: 12569
expires: Sun, 25 Apr 2021 13:22:41 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://rs.adocean.pl/__/_1619443360/ad.js?hclsdata=&hcudata=Qqks2FqWpmOoJhUNAbVu4fuwyAIh3NB3ZgKFJf8JuCf.17&id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 24ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/pLW1P-3X_Ppr5/www.espreso.co.rs/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8000d797097e74bfff377d2f3fca7e046ee4490ea4edb70c2c0b189575847629

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
etag: "9iaPKZLFg6XYoMRMhilE8g=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Mon, 03 May 2021 13:22:41 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 278 KB
77 KB 45ms
44ms Script
text/javascript 2600:9000:20c8:9c00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=www.espreso.co.rs
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/pLW1P-3X_Ppr5/www.espreso.co.rs/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:9c00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 29507fd3a172d0d54a23c53defa95fe78dbf477c5577b7b789abc2946c8a40d8

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
last-modified: Wed, 10 Mar 2021 17:11:22 GMT
server: AmazonS3
x-amz-cf-pop: MAD50-C1
etag: W/"814cf3c7bdd5dafb6ad642c1b52006c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 3f18bbc133cf4ddae8afcd8a83c77a98.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-id: AkRmVpiQQxGf4jasSulkeSHiClKBotyaWH75k4r15NKVUukC97LdAg==

GET
H2 200 fpdata.js Show response
gars.hit.gemius.pl/ 282 B
394 B 68ms
68ms Script
application/x-javascript 87.237.206.234
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://gars.hit.gemius.pl/fpdata.js?href=glossy.espreso.co.rs
Requested by: Host: gars.hit.gemius.pl
URL: https://gars.hit.gemius.pl/xgemius.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.234 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: f29f5f43a67d089673cc57e4c2b7b86a27bdc695b21344f63e4c58abbc8d2ab4

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
last-modified: Mon, 16 Jul 2012 10:03:40 GMT
server: GHC
etag: PRIVATE7520710249
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: private, max-age=2592000
accept-ranges: none
content-type: application/x-javascript
content-length: 282
expires: Wed, 26 May 2021 13:22:41 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
93 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-67410988-1&cid=522392882.1619443361&jid=722668455&gjid=346475751&_gid=955939869.1619443361&_u=IGBAgEABAAAAAE~&z=205571432

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 26 Apr 2021 13:22:41 GMT
content-type: text/plain
access-control-allow-origin: https://glossy.espreso.co.rs
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1275643351&t=pageview&_s=1&dl=https%3A%2F%2Fglossy.espreso.co.rs%2F&ul=en-us&de=UTF-8&dt=Glossy&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGDAAEABAAAAAG~&jid=2085891141&gjid=2093183908&cid=522392882.1619443361&tid=UA-86981738-2&_gid=955939869.1619443361&_r=1&_slc=1&z=1505122255

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://glossy.espreso.co.rs
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j90&a=1275643351&t=pageview&_s=1&dl=https%3A%2F%2Fglossy.espreso.co.rs%2F&ul=en-us&de=UTF-8&dt=Glossy&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBAgEAB~&jid=722668455&gjid=346475751&cid=522392882.1619443361&tid=UA-67410988-1&_gid=955939869.1619443361&z=2010025782

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 04:38:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 31447
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-pLW1P-3X_Ppr5.js Show response
rules.quantcount.com/ 3 B
355 B 460ms
381ms Script
application/x-javascript 2600:9000:20c8:f200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-pLW1P-3X_Ppr5.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:f200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:21:50 GMT
via: 1.1 95f1b7018f5640d0a596bfddfbb25f68.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 51
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
cache-control: max-age=300
x-amz-cf-pop: MAD50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: -jwj950vG0YIA5EmrFXCHpulEixgmen515hyeesAdokX2H6j8PqpPw==

GET
H3-29 200 ga-audiences
www.google.com/ads/ 42 B
63 B 32ms
29ms Image
image/gif 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-67410988-1&cid=522392882.1619443361&jid=722668455&_u=IGBAgEABAAAAAE~&z=1389407636

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
505 B 63ms
33ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-67410988-1&cid=522392882.1619443361&jid=722668455&_u=IGBAgEABAAAAAE~&z=1389407636

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 92 KB
24 KB 23ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0ae5ed57dc48abbee125d5f915e37110c9f2bb6a95d1aa5ccf3c141f8fe10db3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23961
x-fb-rlafr: 0
pragma: public
x-fb-debug: INJ32rTn0q7eqal+4krSIAOhpxdiqUj2MBdMcy1zRQ2Kt25YjHc2yDEpnihzFca45ZRSLQM2tuYGd4xJaxt2tQ==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 26 Apr 2021 13:22:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ 44 KB
44 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 15:44:08 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
age: 337113
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45416
x-xss-protection: 0
expires: Fri, 22 Apr 2022 15:44:08 GMT

GET
H2 200 pubads_impl_2021042001.js Show response
securepubads.g.doubleclick.net/gpt/ 301 KB
106 KB 154ms
53ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

a2aca9aa200ad3e4dd9afcd27fd2bd5b272a5d297e9f85d708394857ca6a1ffe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 20 Apr 2021 08:40:14 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 107961
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:41 GMT

GET
H2 200 logo.svg
glossy.espreso.co.rs/resources/images/svg/ 5 KB
3 KB 51ms
50ms Image
image/svg+xml 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/resources/images/svg/logo.svg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 047ed5c1bcaea807f1edb61af9be9d808c474d7ae00dd2577067ad4adbcffd29

Request headers

:path: /resources/images/svg/logo.svg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:38 GMT
content-encoding: gzip
age: 2
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web2 time for request D=1055
content-length: 2249
x-haste-perspective: desktop
last-modified: Wed, 13 Jan 2021 11:32:19 GMT
server: Haste
etag: "14b4-5b8c67dee79e7-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-haste-hits: 2
accept-ranges: bytes
x-haste-cacheable: YES
expires: 0

GET
H3-29 200 jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v12/ 46 KB
46 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 21:19:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
age: 316973
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46988
x-xss-protection: 0
expires: Fri, 22 Apr 2022 21:19:48 GMT

GET
H3-29 200 EJRSQgYoZZY2vCFuvAnt66qSVys.woff2
fonts.gstatic.com/s/ptserif/v12/ 29 KB
29 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptserif/v12/EJRSQgYoZZY2vCFuvAnt66qSVys.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 05:02:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:05:20 GMT
server: sffe
age: 375585
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29400
x-xss-protection: 0
expires: Fri, 22 Apr 2022 05:02:56 GMT

GET
H3-29 200 EJRVQgYoZZY2vCFuvAFWzr8.woff2
fonts.gstatic.com/s/ptserif/v12/ 32 KB
32 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptserif/v12/EJRVQgYoZZY2vCFuvAFWzr8.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 10:30:03 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:06:03 GMT
server: sffe
age: 355958
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32960
x-xss-protection: 0
expires: Fri, 22 Apr 2022 10:30:03 GMT

GET
H3-29 200 jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2
fonts.gstatic.com/s/ptsans/v12/ 29 KB
29 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0OCtLQ0Z.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e4563071048dd98f7120d73d55aa8f31fef27b1c1cf600eb38306421078153d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 01:32:04 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:26 GMT
server: sffe
age: 561037
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29328
x-xss-protection: 0
expires: Wed, 20 Apr 2022 01:32:04 GMT

GET
H3-29 200 EJRSQgYoZZY2vCFuvAnt66qcVyvHpA.woff2
fonts.gstatic.com/s/ptserif/v12/ 19 KB
19 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptserif/v12/EJRSQgYoZZY2vCFuvAnt66qcVyvHpA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba462692b44ec826922965ea262e87e2fa936c82383982380b10b898444cf90f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Apr 2021 10:03:41 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:05:19 GMT
server: sffe
age: 98340
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19220
x-xss-protection: 0
expires: Mon, 25 Apr 2022 10:03:41 GMT

GET
H3-29 200 EJRVQgYoZZY2vCFuvAFYzr-tdg.woff2
fonts.gstatic.com/s/ptserif/v12/ 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptserif/v12/EJRVQgYoZZY2vCFuvAFYzr-tdg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be36bf0f2001beedfdeec85a65ee55b6b610f5466b59ca38c7a427c553f9195c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 15:35:34 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:06:08 GMT
server: sffe
age: 337627
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21172
x-xss-protection: 0
expires: Fri, 22 Apr 2022 15:35:34 GMT

GET
H3-29 200 322513038446696 Show response
connect.facebook.net/signals/config/ 254 KB
72 KB 10ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/322513038446696?v=2.9.39&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

747c62cccc8808468e268f1ca31fb38eacb3362e8a8c10b5b80b797b049e88b3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 74168
x-fb-rlafr: 0
pragma: public
x-fb-debug: xFiENFg5unRPl+T91uKmwohTFLYHPWeM8rOjU5RE/LY4aJZEH5uN59xqCtoX+0xNFcOf29gglcV1XLnjtCK3PA==
x-frame-options: DENY
date: Mon, 26 Apr 2021 13:22:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 rexdot.js Show response
gars.hit.gemius.pl/_1619443361423/ 169 B
574 B 85ms
84ms Script
application/x-javascript 87.237.206.234
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://gars.hit.gemius.pl/_1619443361423/rexdot.js?l=100&id=.Wqab_7.PymlI6QznIZAr5eCDkaUbycwxOudM3_kSXz.M7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fglossy.espreso.co.rs%2F&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7&vis=1
Requested by: Host: gars.hit.gemius.pl
URL: https://gars.hit.gemius.pl/xgemius.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.234 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: 971263b0413ee5a5d404b27679aa956199c29bf413a8af6d977f2fdc32a5a0c9

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-type: application/x-javascript
content-length: 169
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H2 200 pym.v1.min.js Show response
pym.nprapps.org/ 9 KB
3 KB 237ms
50ms Script
application/javascript 13.224.193.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pym.nprapps.org/pym.v1.min.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b7f736144a4c3c86a1e620f94d91b3c0eedcadac33888203e554dc2e7c3cfa66

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 02:06:40 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:23:08 GMT
server: AmazonS3
age: 40562
etag: "dfb7091815cbff12a30bfad66911926f"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: FRA2-C1
content-length: 2818
x-amz-cf-id: MIRicfdOssociVXL-Ohsha6o-iylxRsk3yZe7jLVKthHPEmsazCy5w==

GET
H2 200 /
www.facebook.com/tr/ 44 B
408 B 19ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=322513038446696&ev=PageView&dl=https%3A%2F%2Fglossy.espreso.co.rs%2F&rl=&if=false&ts=1619443361453&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=30&fbp=fb.2.1619443361451.391905221&it=1619443361355&coo=false&rqm=GET

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Apr 2021 13:22:41 GMT

GET
H2

200

repoint.gif
alt.hudb.pl/__/_1619443361482/
Redirect Chain

https://alt.hudb.pl/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7...
https://alt.hudb.pl/__/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D8870161944336148...

43 B
199 B

45ms
45ms

Image
image/gif

137.74.0.158
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alt.hudb.pl/__/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D0
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.74.0.158 Warsaw, Poland, ASN16276 (OVH, FR),
Reverse DNS
Software: GHC /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-type: image/gif
content-length: 43
expires: Sun, 25 Apr 2021 13:22:41 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1619443361482/repoint.gif?id=10ZL__tKNMmbYXfT6Pa8D7cc.jhwbe86CT6t3N9b9W3.87&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D0
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H2

200

redot.gif
alt.adocean.pl/__/_1619443361482/
Redirect Chain

https://alt.adocean.pl/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%...
https://alt.adocean.pl/__/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D887016194433614...

43 B
226 B

49ms
49ms

Image
image/gif

137.74.0.158
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alt.adocean.pl/__/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D1
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.74.0.158 Warsaw, Poland, ASN16276 (OVH, FR),
Reverse DNS
Software: GHC /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-type: image/gif
content-length: 43
expires: Sun, 25 Apr 2021 13:22:41 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1619443361482/redot.gif?id=1_XlneraySw7LL8m2QmY8bdeT.RwIcSaaWLV1n_0kKv.O7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D1
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-length: 0
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H2 200 redot.gif
rs.hit.gemius.pl/_1619443361482/ 43 B
308 B 91ms
67ms Image
image/gif 87.237.206.234
MNSHA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rs.hit.gemius.pl/_1619443361482/redot.gif?id=bVnr24M7JJDtjp3qdxyvFZchT.SgXsSakv3V1jPYkKv.u7&fpdata=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361&extra=_unique%3D88701619443361482%7C_order%3D2
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.234 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
accept-ranges: none
content-type: image/gif
content-length: 43
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H2 200 network_sprite.svg
glossy.espreso.co.rs/resources/images/footer/ 61 KB
26 KB 73ms
50ms Image
image/svg+xml 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/resources/images/footer/network_sprite.svg?v3.6
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/resources/css/main-v-16107096751945.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 39e110d013cee5277b6be02ea51c5b08319dd79697aa19bd2a191f47d7ca26fb

Request headers

:path: /resources/images/footer/network_sprite.svg?v3.6
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/resources/css/main-v-16107096751945.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/resources/css/main-v-16107096751945.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:21:56 GMT
content-encoding: gzip
age: 44
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web2 time for request D=9761
content-length: 26575
x-haste-perspective: desktop
last-modified: Wed, 13 Jan 2021 11:32:19 GMT
server: Haste
etag: "f2d0-5b8c67dee6a47-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-haste-hits: 27
accept-ranges: bytes
x-haste-cacheable: YES
expires: 0

GET
H3-29 200 jizaRExUiTo99u79D0yExdGM.woff2
fonts.gstatic.com/s/ptsans/v12/ 26 KB
26 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0yExdGM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Serif:400,700|PT+Sans:400,700&subset=latin,latin-ext,cyrillic-ext,cyrillic

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cc569a18a9dfd7f191b5cf516e335c67255047ffbd4da0f1e8109598665ada8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 21:25:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:20 GMT
server: sffe
age: 316613
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26408
x-xss-protection: 0
expires: Fri, 22 Apr 2022 21:25:48 GMT

POST
H2 200 extra=;
adrs.hit.gemius.pl/_1619443361512/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=qddqkpqfzw/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/ 2 B
251 B 71ms
70ms Ping
application/x-javascript 87.237.206.235
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adrs.hit.gemius.pl/_1619443361512/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=qddqkpqfzw/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/extra=;
Requested by: Host: rs.adocean.pl
URL: https://rs.adocean.pl/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.235 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
access-control-allow-origin: https://glossy.espreso.co.rs
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
accept-ranges: none
content-type: application/x-javascript
content-length: 2
expires: Sun, 25 Apr 2021 13:22:41 GMT

POST
H2 200 extra=;
adrs.hit.gemius.pl/_1619443361514/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=ugpjiuhiig/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/ 2 B
185 B 73ms
73ms Ping
application/x-javascript 87.237.206.235
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adrs.hit.gemius.pl/_1619443361514/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=ugpjiuhiig/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/extra=;
Requested by: Host: rs.adocean.pl
URL: https://rs.adocean.pl/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.235 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
access-control-allow-origin: https://glossy.espreso.co.rs
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
accept-ranges: none
content-type: application/x-javascript
content-length: 2
expires: Sun, 25 Apr 2021 13:22:41 GMT

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 8ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bc04165c9415d89ca2185d6f86d6244a627b78b65fba5ee6304cb54fe25e799d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: hUtOBP2F9/K6GA/K5oU0ew==
cross-origin-resource-policy: cross-origin
expires: Mon, 26 Apr 2021 13:41:54 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1779
x-fb-rlafr: 0
x-fb-debug: poTNwNE9hcyEfA/wXeunCp+vAJT0bZcdFqXAJq12NbHGPJmnDIs4zztPnBgS1ebl2En0zGui0nUBeW2QqDAfeg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 9f58d9d2cf5bc7580284836247993d56
date: Mon, 26 Apr 2021 13:22:41 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "1833566f31b50d5f222f8ade4c29c0e3"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

POST
H2 200 extra=;
adrs.hit.gemius.pl/_1619443361515/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=mahgnkjtri/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/ 2 B
185 B 113ms
112ms Ping
application/x-javascript 87.237.206.235
MNSHA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adrs.hit.gemius.pl/_1619443361515/redot.js/id=1wBFX2NdmcVEPm1CLp.yBJdS71aIBw72DvXBUrDBScj.b7/stparam=mahgnkjtri/fastid=hywsuoxizalypgkdgkcqdetlxpnb/sarg=6086BEA0585A5DC3/extra=;
Requested by: Host: rs.adocean.pl
URL: https://rs.adocean.pl/_1619443360391/ad.js?id=JQtFtXCFPcJUZVVI5pZCvzIEE6D.z.ImzfgWQA2cBz7.x7/adov=4.2.0/x=1600/y=1200/page_url=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 87.237.206.235 , Serbia, ASN51859 (MNSHA-AS, RS),
Reverse DNS
Software: GHC /
Resource Hash: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
access-control-allow-origin: https://glossy.espreso.co.rs
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
accept-ranges: none
content-type: application/x-javascript
content-length: 2
expires: Sun, 25 Apr 2021 13:22:41 GMT

POST
H2 200 check_if_user_is_logged_in Show response
glossy.espreso.co.rs/profil/ 115 B
298 B 205ms
204ms XHR
text/html 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://glossy.espreso.co.rs/profil/check_if_user_is_logged_in
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/resources/js/main-v-16107096751945.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Apache /
Resource Hash: 22882a69a2cd613b25bc774dded2d9d71c97bf0677d764e8bd270402a6802688

Request headers

sec-fetch-mode: cors
origin: https://glossy.espreso.co.rs
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
content-length: 0
:path: /profil/check_if_user_is_logged_in
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Accept: */*
Referer: https://glossy.espreso.co.rs/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
set-cookie: X-Proxy-To=glossy-web1; path=/
x-backend-server: glossy-web1 time for request D=3958
content-length: 92

GET
H2 200 320390_profimedia0607942202_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/11/ 60 KB
60 KB 51ms
50ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/11/320390_profimedia0607942202_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 273c6cb3871ed1aa5ca95cbcea10b5b1d54b2ce529a4f210b4837b9212bab215

Request headers

:path: /data/images/2021/04/26/11/320390_profimedia0607942202_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:14:52 GMT
age: 469
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq1.itplatforma.com
x-backend-server: glossy-web1 time for request D=1082
content-length: 61358
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 09:25:06 GMT
server: Haste
etag: "efae-5c0dcb8a8260d"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 9
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 320398_ruske-kape_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/13/ 50 KB
50 KB 95ms
94ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/13/320398_ruske-kape_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 9bcc6c1e0e30ed82d985e163a32d30e2c111057303c3dbbe47c5f841db8e527f

Request headers

:path: /data/images/2021/04/26/13/320398_ruske-kape_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:14:57 GMT
age: 463
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web1 time for request D=956
content-length: 50742
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 11:40:07 GMT
server: Haste
etag: "c636-5c0de9b7fabdc"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 37
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 320387_aromadifuzerpocetna_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/09/ 53 KB
54 KB 115ms
114ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/09/320387_aromadifuzerpocetna_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 03b4bcbb92f06b59938e69d4acff3affaa6f1b4710cd752d163b2a74146fa0c2

Request headers

:path: /data/images/2021/04/26/09/320387_aromadifuzerpocetna_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:18 GMT
age: 23
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web1 time for request D=101724
content-length: 54436
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 07:40:39 GMT
server: Haste
etag: "d4a4-5c0db431c4ebe"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 2
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 82976237305-shutterstock1623018577-share_sq-s.jpg
glossy.espreso.co.rs/data/images/external/2021/04/26/15/ 54 KB
55 KB 178ms
177ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/external/2021/04/26/15/82976237305-shutterstock1623018577-share_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 3f6f9bf92a91e2f4b672896559da3642583af347fe3b771ad205011e567e4e50

Request headers

:path: /data/images/external/2021/04/26/15/82976237305-shutterstock1623018577-share_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:19:29 GMT
age: 191
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web1 time for request D=839
content-length: 55401
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 13:03:27 GMT
server: Haste
etag: "d869-5c0dfc57b9de9"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 23
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 53834248639-enisukunda-share_sq-s.jpg
glossy.espreso.co.rs/data/images/external/2021/04/26/15/ 19 KB
19 KB 180ms
179ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/external/2021/04/26/15/53834248639-enisukunda-share_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 64a392480eadf7c422883153ce5ef2d7035e85549f80365ec48fa87b98ffe2b6

Request headers

:path: /data/images/external/2021/04/26/15/53834248639-enisukunda-share_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:18:48 GMT
age: 233
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq2.itplatforma.com
x-backend-server: glossy-web1 time for request D=949
content-length: 19192
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 13:03:10 GMT
server: Haste
etag: "4af8-5c0dfc47b63c6"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 27
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 320399_anja-valente_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/14/ 36 KB
36 KB 183ms
182ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/14/320399_anja-valente_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: 9cad9b3c62dfa30964a1f0c1d01301156766fc1e5e1836f8819282a49b964ce6

Request headers

:path: /data/images/2021/04/26/14/320399_anja-valente_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:17:45 GMT
age: 295
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq3.itplatforma.com
x-backend-server: glossy-web2 time for request D=930
content-length: 36573
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 12:35:36 GMT
server: Haste
etag: "8edd-5c0df61e5e264"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 37
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 320383_248573-profimedia0607913516-ls_sq-s.jpg
glossy.espreso.co.rs/data/images/2021/04/26/09/ 43 KB
43 KB 198ms
198ms Image
image/jpeg 185.80.68.6
PROVIDUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://glossy.espreso.co.rs/data/images/2021/04/26/09/320383_248573-profimedia0607913516-ls_sq-s.jpg
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.68.6 , Serbia, ASN43191 (PROVIDUS-AS, RS),
Reverse DNS
Software: Haste /
Resource Hash: a9332c448983466e12f379523fee262d67f6bc315fa2c0c174cb04b2aee67eec

Request headers

:path: /data/images/2021/04/26/09/320383_248573-profimedia0607913516-ls_sq-s.jpg
pragma: no-cache
cookie: _ga=GA1.3.522392882.1619443361; _gid=GA1.3.955939869.1619443361; _gat=1; _gat_tstTracker=1; __gfp_64b=EnXchs.mgvQ3VpAvxOsMYUlhyLhDRF6nKHEY2oVnC0P.m7|1619443361; _fbp=fb.2.1619443361451.391905221
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: glossy.espreso.co.rs
referer: https://glossy.espreso.co.rs/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:11:29 GMT
age: 671
x-haste-cache: HIT
x-haste-debug-backend: glossyTHQ
x-haste-node: ha-thq4.itplatforma.com
x-backend-server: glossy-web1 time for request D=1782
content-length: 43600
x-haste-perspective: desktop
last-modified: Mon, 26 Apr 2021 07:10:15 GMT
server: Haste
etag: "aa50-5c0dad658f467"
content-type: image/jpeg
cache-control: max-age = 315360000, public
x-haste-hits: 55
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 56ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=glossy.espreso.co.rs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 54ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=glossy.espreso.co.rs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 13:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 174 KB
42 KB 639ms
586ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1050904863290207&correlator=668997976607012&output=ldjh&impl=fifs&eid=31060746%2C31060870&vrg=2021042001&ptt=17&gdpr=1&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20210426&iu_parts=338515395%2Cglossy%2Cglossy_desk_id1%2Cglossy_desk_id2%2Cglossy_desk_id3%2Cglossy_desk_id4&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C970x500%7C998x90%7C998x180%7C998x250%7C998x500%7C970x180%7C970x250%2C300x250%7C300x600%2C300x600%7C300x250&cust_params=glossy_espreso_pages%3Dhome%26r%3D7%26r2%3D3&cookie_enabled=1&bc=31&abxe=1&lmt=1619443361&dt=1619443361623&dlt=1619443360172&idt=1377&frm=20&biw=1600&bih=1200&oid=3&adxs=552%2C320%2C980%2C980&adys=15%2C210%2C840%2C2131&adks=2341537960%2C2049153674%2C437793788%2C1605551008&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fglossy.espreso.co.rs%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x110%7C960x524%7C300x278%7C300x628&msz=728x-1%7C960x500%7C300x250%7C300x600&ga_vid=522392882.1619443361&ga_sid=1619443362&ga_hid=1275643351&ga_fc=false&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

4410d5893c95822f69d5b732be82b6d44878ffc8d202e17eed0c5b47f9f4e38b

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNPrvdKAnPACFY3ZEQgdOpAAZA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNPrvdKAnPACFY3ZEQgdOpAAZA&gqi=&layout=/sadbundle/%24csp%253Der3%24/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1,-1,-1,-1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43044
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
date: Mon, 26 Apr 2021 13:22:42 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://glossy.espreso.co.rs
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 31ms
14ms Other
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ 0
0 29ms
5ms Other
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ 218 KB
65 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=ee547ead829f4697ccd8ed78232f47de&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9d41ade4e2e972e30e03396fe9a9a6533e9791f3a91913a89883911005715726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://glossy.espreso.co.rs
Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: w4tGw7lr77pypbvTTyhpZg==
cross-origin-resource-policy: cross-origin
expires: Tue, 26 Apr 2022 12:01:08 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 66009
x-fb-rlafr: 0
x-fb-debug: wOHH8ZtiK9nl25jy0x4LVKhQjlvxK+Ppv5rrY8Mgg4GjE2jjmnKnboalG4RcRSW2IJ95XnG7Mv295T5asxySsQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 7102804f24480e88ef46589cacb0fd9a
date: Mon, 26 Apr 2021 13:22:41 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "9ab63992c9ee3763218daebfc20a5e6f"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1864170247150479&ev=fb_page_view&dl=https%3A%2F%2Fglossy.espreso.co.rs%2F&rl=&if=false&ts=1619443361677&sw=1600&sh=1200&at=

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Mon, 26 Apr 2021 13:22:41 GMT

GET
H2 200 / Show response
www.kurir.rs/news_widget_amc/ Frame AB01 20 KB
7 KB 215ms
92ms Document
text/html 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Requested by: Host: pym.nprapps.org
URL: https://pym.nprapps.org/pym.v1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: 6cbdabe0f41b8533fc2e0e663541154462faa10eb63a8c7dfc7447e6a079ba7b

Request headers

:method: GET
:authority: www.kurir.rs
:scheme: https
:path: /news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://glossy.espreso.co.rs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://glossy.espreso.co.rs/

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
vary: Accept-Encoding
content-encoding: gzip
x-backend-server: kurir-web2 time for request D=6071
access-control-allow-origin: *
content-length: 6639
content-type: text/html; charset=UTF-8
server: Haste
x-haste-cacheable: YES
expires: 0
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-haste-perspective: desktop
age: 0
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr1.itplatforma.com
x-haste-cache: MISS
accept-ranges: bytes
x-haste-cfg: be_cache_varnish/haste-fr1

GET
H2 200 pixel;r=1947169888;source=choice;rf=0;a=p-pLW1P-3X_Ppr5;url=https%3A%2F%2Fglossy.espreso.co.rs%2F;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=1558287b-20210421211215;cm=;gdpr=1;gdpr_consent=;ref=;d=espreso.co.rs...
pixel.quantcount.com/ 35 B
210 B 10ms
9ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantcount.com/pixel;r=1947169888;source=choice;rf=0;a=p-pLW1P-3X_Ppr5;url=https%3A%2F%2Fglossy.espreso.co.rs%2F;uh=u;uht=u;ns=0;ce=1;qjs=1;qv=1558287b-20210421211215;cm=;gdpr=1;gdpr_consent=;ref=;d=espreso.co.rs;je=0;sr=1600x1200x24;dst=1;et=1619443361684;tzo=-120;ogl=title.Glossy%2Cimage.%2Ctype.article%2Curl.https%3A%2F%2Fglossy%252Eespreso%252Eco%252Ers%2F%2Csite_name.Glossy%2Cdescription.

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:41 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 pym.v1.min.js Show response
www.kurir.rs/resources/js/ Frame AB01 7 KB
3 KB 264ms
264ms Script
application/javascript 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.kurir.rs/resources/js/pym.v1.min.js
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: ff3587135389fc0f7399474f84d6bff086059dbcb13d9b4e64b495d72ba4e4c7

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr3
date: Mon, 26 Apr 2021 13:08:11 GMT
content-encoding: gzip
age: 870
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr3.itplatforma.com
x-backend-server: kurir-web3 time for request D=1151
content-length: 2193
x-haste-perspective
last-modified: Mon, 08 Mar 2021 12:01:12 GMT
server: Haste
etag: "1bc3-5bd0530ad1040-gzip"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 1082
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2546611_ehed_ls-s.jpg
www.kurir.rs/data/images/2021/04/26/15/ Frame AB01 55 KB
56 KB 62ms
61ms Image
image/jpeg 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.kurir.rs/data/images/2021/04/26/15/2546611_ehed_ls-s.jpg
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: e521da0465249a9e941cbbcc580b715b26607768d0b055c29c1de2778995e8d6

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr2
date: Mon, 26 Apr 2021 13:21:39 GMT
age: 62
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr2.itplatforma.com
x-backend-server: kurir-web5 time for request D=711
content-length: 56831
x-haste-perspective
last-modified: Mon, 26 Apr 2021 13:11:43 GMT
server: Haste
etag: "ddff-5c0dfe30f0653"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 551
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2546621_screenshot-3_ls-s.jpg
www.kurir.rs/data/images/2021/04/26/15/ Frame AB01 29 KB
30 KB 289ms
288ms Image
image/jpeg 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.kurir.rs/data/images/2021/04/26/15/2546621_screenshot-3_ls-s.jpg
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: 82bba5218cd7c1085787943d23084963890411a3dbcd415e518eb498fafa45f4

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr3
date: Mon, 26 Apr 2021 13:19:39 GMT
age: 182
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr3.itplatforma.com
x-backend-server: kurir-web1 time for request D=3144
content-length: 30189
x-haste-perspective
last-modified: Mon, 26 Apr 2021 13:18:57 GMT
server: Haste
etag: "75ed-5c0dffcf898d7"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 968
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2544847_oruzje-belivuk-foto-stefan-stojanovic-mondo-mup-rs--1_ls-s.jpg
www.kurir.rs/data/images/2021/04/24/19/ Frame AB01 63 KB
64 KB 74ms
74ms Image
image/jpeg 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.kurir.rs/data/images/2021/04/24/19/2544847_oruzje-belivuk-foto-stefan-stojanovic-mondo-mup-rs--1_ls-s.jpg
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: 9a2bde2930285c7818358ae512c16f7997642ca0a8407c917b88d8580821d01a

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr1
date: Mon, 26 Apr 2021 13:21:39 GMT
age: 62
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr1.itplatforma.com
x-backend-server: kurir-web1 time for request D=1248
content-length: 64602
x-haste-perspective
last-modified: Sat, 24 Apr 2021 17:30:56 GMT
server: Haste
etag: "fc5a-5c0bb466ad1ed"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 287
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2546329_collage_ls-s.jpg
www.kurir.rs/data/images/2021/04/26/13/ Frame AB01 52 KB
52 KB 92ms
91ms Image
image/jpeg 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.kurir.rs/data/images/2021/04/26/13/2546329_collage_ls-s.jpg
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: 7e31d2ba04a716769dc0792554ec863f94710055d55e184e00c061d7616856e0

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr2
date: Mon, 26 Apr 2021 13:21:39 GMT
age: 62
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr2.itplatforma.com
x-backend-server: kurir-web4 time for request D=1167
content-length: 52831
x-haste-perspective
last-modified: Mon, 26 Apr 2021 11:06:06 GMT
server: Haste
etag: "ce5f-5c0de21d73bb7"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 292
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2546501_lrq5jm.gif
www.kurir.rs/data/images/2021/04/26/13/ Frame AB01 5 MB
5 MB 103ms
103ms Image
image/gif 51.159.89.0
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.kurir.rs/data/images/2021/04/26/13/2546501_lrq5jm.gif
Requested by: Host: www.kurir.rs
URL: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.89.0 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Haste /
Resource Hash: f090227023cb717d36a8b88f36dd15225aebc4796d398c2625d2fa1743f3bf71

Request headers

Referer: https://www.kurir.rs/news_widget_amc/?website=glossy&source=widget&campaign=adria_internal&initialWidth=300&childId=kurir-sidebar-widget&parentTitle=Glossy&parentUrl=https%3A%2F%2Fglossy.espreso.co.rs%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haste-cfg: be_cache_varnish/haste-fr2
date: Mon, 26 Apr 2021 13:21:39 GMT
age: 62
x-haste-cache: HIT
x-haste-debug-backend: kurirTHQ
x-haste-node: haste-fr2.itplatforma.com
x-backend-server: kurir-web2 time for request D=2730
content-length: 5592113
x-haste-perspective
last-modified: Mon, 26 Apr 2021 11:47:09 GMT
server: Haste
etag: "555431-5c0deb49cd9ef"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age = 315360000, public
x-haste-hits: 654
accept-ranges: bytes
x-haste-cacheable: YES
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=322513038446696&ev=Microdata&dl=https%3A%2F%2Fglossy.espreso.co.rs%2F&rl=&if=false&ts=1619443361961&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Glossy%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22Glossy%22%2C%22og%3Aimage%22%3A%22%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fglossy.espreso.co.rs%2F%22%2C%22og%3Asite_name%22%3A%22Glossy%22%2C%22og%3Adescription%22%3A%22%22%2C%22article%3Apublisher%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fglossy.rs%2F%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.39&r=stable&ec=1&o=30&fbp=fb.2.1619443361451.391905221&it=1619443361355&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Mon, 26 Apr 2021 13:22:41 GMT

GET
H2 200 container.html Show response
fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AD70 6 KB
3 KB 8ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://glossy.espreso.co.rs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://glossy.espreso.co.rs/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 26 Apr 2021 13:22:41 GMT
expires: Tue, 26 Apr 2022 13:22:41 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4956137c69656045c048a157aaa84859657bbc7744019d26cce6b5bded84cc49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1619017352525402"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28270
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:42 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012103020108001/ Frame 7194 190 KB
54 KB 63ms
17ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e553b4e88ac4a1819d608fe9dcb46544ca5fb776d4e0c84d773f37b1df18211

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 459245
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55046
x-xss-protection: 0
server: sffe
date: Wed, 21 Apr 2021 05:48:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aeaf363b1ad89b36"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Apr 2022 05:48:37 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 7194 12 KB
5 KB 69ms
23ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9560479a05fb86854546c40ec030edc2bac692d4142391d69b16e5c033a185

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 308905
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4548
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 23:34:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4eb73d471ab4cb2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 23:34:17 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 7194 87 KB
27 KB 52ms
8ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f768cbb894f2690011ee62662d3ac9480d12f5088fa46be57e650fcc4d835c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 315573
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27208
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 21:43:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "22950e05e749846e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 21:43:09 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 7194 27 KB
9 KB 57ms
14ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21d45a4ed77653b3b1ee2b47a786a4dbb936a3b19fc56e1b44c16aed35eb80ee

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 337627
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9587
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 15:35:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "739644f32ad1483f"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 15:35:35 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame 7194 40 KB
13 KB 71ms
28ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6af60796cc240ad277098308cf363c2700f5296264ec1b43b4e1362763c439

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 489907
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12827
x-xss-protection: 0
server: sffe
date: Tue, 20 Apr 2021 21:17:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5cc8dcc2368726c7"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 21:17:35 GMT

GET
DATA 200
OK truncated
/ Frame 7194 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 288408f94c8544316dfcb09ef48ffc118d5498b80953c36318482a5ddffcfdf2

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 12029123908616896856
tpc.googlesyndication.com/simgad/ Frame 7194 77 KB
77 KB 17ms
15ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12029123908616896856?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4ql4hDUsJ6r1jdEGRh8Ffn4s0RK3vA

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae530631222f885227d5eb22e80ead92d518178c9e18357ebb9d0fee47d8369b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 07:20:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 03 Feb 2020 11:08:28 GMT
server: sffe
age: 367340
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78527
x-xss-protection: 0
expires: Fri, 22 Apr 2022 07:20:22 GMT

GET
H2 200 sr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7194 3 KB
3 KB 9ms
7ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/sr.png

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

740981e13ae6d521bd5893d76539e47822919cdf4f1a99841b3d9e5e16b9497f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 04:17:50 GMT
x-content-type-options: nosniff
server: cafe
age: 32692
etag: 114314232294822369
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2855
x-xss-protection: 0
expires: Tue, 27 Apr 2021 04:17:50 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7194 344 B
570 B 8ms
6ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Apr 2021 21:00:17 GMT
x-content-type-options: nosniff
server: cafe
age: 58945
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Mon, 26 Apr 2021 21:00:17 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7194 0
0 98ms
96ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CAImyob6GYJWXLY2zx_APuqCCoAaw0aa5YerprJnMDcf43Zi6ARABIPPwpEZg6eTJhdgaoAGH9OrBA8gBAqkC-ObxZnnXkT7gAgCoAwHIAwiqBOkBT9CGWwjHFbN6aWztHfQpimZvYtfamPTz4sU6BNXQU1CmT0K5b0YaVrSjhgEH2RMgj3eynQIsFR-TQYSqsw7gZfTF8S0E1w_PMLinW8gZcOB-IgzMT0oqjcnEGna0Io1T_op55kpjSpllezcL4K0bty8y15TxgL6YwBLiCjQ5HA8-D7q9g9Hf5Kw5dZ3whtzC9qUVVhw0OvOX7HTv1kaNXElVPP3CYSkeh9CqKNwlCVPRaXc3FesqwXkdaUiXe0GNQAwFJo6w1jOh26u-Jm9vkhfFNcgZVBp6I2QIeCdbr2Om9skx6eXoEXPABJLEqO22A-AEAZIFBAgEGAGSBQQIBRgEoAYCgAfhi5U-qAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEJG6BNIICQiA4YBQEAEYHYAKA8gLAdgTDZgWAbIXGgoYCAASFHB1Yi02MjA5MTU1NzgxNTQxMDc0&sigh=9ZMUiZ1_c74
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012103020108001/ Frame B90B 190 KB
54 KB 39ms
24ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e553b4e88ac4a1819d608fe9dcb46544ca5fb776d4e0c84d773f37b1df18211

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 459245
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55046
x-xss-protection: 0
server: sffe
date: Wed, 21 Apr 2021 05:48:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aeaf363b1ad89b36"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Apr 2022 05:48:37 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame B90B 12 KB
5 KB 43ms
29ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f9560479a05fb86854546c40ec030edc2bac692d4142391d69b16e5c033a185

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 308905
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4548
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 23:34:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4eb73d471ab4cb2c"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 23:34:17 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame B90B 87 KB
27 KB 43ms
29ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6f768cbb894f2690011ee62662d3ac9480d12f5088fa46be57e650fcc4d835c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 315573
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27208
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 21:43:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "22950e05e749846e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 21:43:09 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame B90B 27 KB
9 KB 50ms
36ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21d45a4ed77653b3b1ee2b47a786a4dbb936a3b19fc56e1b44c16aed35eb80ee

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 337627
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9587
x-xss-protection: 0
server: sffe
date: Thu, 22 Apr 2021 15:35:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "739644f32ad1483f"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 15:35:35 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012103020108001/v0/ Frame B90B 40 KB
13 KB 51ms
37ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012103020108001/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6af60796cc240ad277098308cf363c2700f5296264ec1b43b4e1362763c439

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 489907
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12827
x-xss-protection: 0
server: sffe
date: Tue, 20 Apr 2021 21:17:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5cc8dcc2368726c7"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 21:17:35 GMT

GET
H3-29 200 sr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame B90B 3 KB
3 KB 35ms
14ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/sr.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

740981e13ae6d521bd5893d76539e47822919cdf4f1a99841b3d9e5e16b9497f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 04:17:50 GMT
x-content-type-options: nosniff
server: cafe
age: 32692
etag: 114314232294822369
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2855
x-xss-protection: 0
expires: Tue, 27 Apr 2021 04:17:50 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame B90B 344 B
368 B 35ms
14ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Apr 2021 21:00:17 GMT
x-content-type-options: nosniff
server: cafe
age: 58945
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Mon, 26 Apr 2021 21:00:17 GMT

GET
DATA 200
OK truncated
/ Frame B90B 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3b80a61e36c2137618d9706a0c11604ff0e1a7cc5157130baf00d51a0062777

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 16228630824492167325
tpc.googlesyndication.com/simgad/ Frame B90B 34 KB
34 KB 35ms
14ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16228630824492167325?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnfFmoMtiHjhfBRpnoJSL7GNh7WTQ

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

910735c361158050b45c59642209beefb43d2665dc774e627fe6d3c2365cf661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 23:24:34 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 08:06:20 GMT
server: sffe
age: 482288
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34550
x-xss-protection: 0
expires: Wed, 20 Apr 2022 23:24:34 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B90B 0
0 19ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTFTXlw_kAUhW5ER6q4msujvQebtpah3XOZ-cDqOZUv4y1eA-xZbveu9yj0gmeNQNIasuMZ
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B90B 0
0 85ms
81ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CTeMdob6GYJaXLY2zx_APuqCCoAaz2-SrYofV3sTSDfWgr6zKIxABIPPwpEZg6eTJhdgaoAHB7pP1A8gBAqkC-ObxZnnXkT7gAgCoAwHIAwiqBOoBT9BDH-dbSGzMVcd0P9QpenNh5Ks7KbsIUxQSPDVaKGkjNhFIWJH4sbB369YCt1Uy84dgrPY2Du9HWCJG3-xlGuPvpVhncDzJNm2ZL38LP2VdT_k_spFBSFQMpv2UVhB3oz_SB3lgSMc2ClP1QrvTQY2XlzHlgVrDzcRPlItTgcaY3HA8LpBqpuyKG-Y64ffq-22S_xyNfW7JHYwTKoA4onQpkENpI5TTGxR8p5kJxjrW7ba8tDQe1Yjimj6NRUznLZ6y2e04zPs8nuKRpF_56buJpbhxcmxR9bOMuz7l1rY4iyiS01riPVy3wAS5m87WwAPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHuezTMagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCr2ArSCAkIgOGAUBABGB2ACgPICwHYEw2yFxoKGAgAEhRwdWItNjIwOTE1NTc4MTU0MTA3NA&sigh=-CCgBNaGyq8
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 container.html Show response
fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D851 6 KB
3 KB 32ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://glossy.espreso.co.rs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://glossy.espreso.co.rs/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 26 Apr 2021 13:22:41 GMT
expires: Tue, 26 Apr 2022 13:22:41 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A2DC 624 B
354 B 24ms
23ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnIzBEFCqy2Z7KJL6CCjWIak-YndCkDBO5RJwSwGjpNgbzylscPajhgghMErsI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 26 Apr 2021 13:22:42 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AD70 43 KB
20 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ae7oyD61oqjUPvDcIwwBBvgN8Hf2zodhoz95shq4dTQE5IX9NVdAqitHk0D3aUwR8aFnv4DMeE6APZT4hiEswTQCuTKTk9WpAPkHjBtAkGLth2rpbrDASRRhqPzaiUHevTqQCr_eh6sHC5b_JBqk3taHwV5A&dbm_d=AKAmf-D7SqZR8kRxk7MK3NbO0MwKoh0eVsbfrTeBSeCy0sx1KJnr1aHPsXWe0bxuZKskFh1Daxr4W7n6Jc3e2gcQ9D6TCOyb5_2gYUqqlZGipKAsex2G3vW2cgZuWZt_MZOvFIT4heKmcm5GIEa2W24nSrFG2GYCSV5R8UfFMrTdvUFAcSyPSSR-tJLnJFjRkX9QeZnkZQsoBZty_SMiZng-M87DFMdA4iGPrlDPDuF31uBIbPdtb720h9eNm8jDE4E0dQMpszsWgFaG6KN2KqKxHFon4aaRQs0B1H3eQK1aLEHvmV41Ql5d5CeOvH2Gc22g9jiZ1IztZcY8xG3Xq3CWcz9M0MUrBJ4IcprQmsBS17IptPjtB8RMZvu4MyHLKw19n3B_NBtjl0BVJpbI9FW56kawtb1P24Pl2lownyqKbojdn-tlbebb2efmCeiZTJ-ZbvQazuINmjLCaI8g-_D6pNQFXf46IKYs4-9bN34jWFRjEDfHHTAuNjxw5WNb3uOTtKX3TTcKT6A3K2D96QeTBqEjvbk9jDWVAE-dlOvvWYZZ_ca0vRGBCeYgGOm2nzqdz9XZuDA_kARsW-K_FTnUxMqJNdXZBdQ5kZtHnsBi8Hwqu-Gv2OmU3hbqvwas_cGVeO8s2WwY4sCp5b0FBNhun08YGGQO7DDMLGb7LouUderKjNZc1xSbsBR8Xs2Ay4AFgNDmAGwLSL_e7rbOZb5CcKzGntB5FEicyRbXYYH_vDeiub5H-qXBalCD0bwCS917hOd2Z-Uy9Mtz5vg3Oa3Z5kfGXmMeg-kZPXuTFHxHeLGOdT1dVz9Nxjfrp1QIPRbwnUi0GAWxzulAOequEB40rKKzIB3U_2cGou-JlfPr_J9vnl-SBuu-5g8unGFmGaVColaS4Qx_3H0UtCfe0s_i-lfFnLF3MwF5daWoZI6yM8ULDbmcUJp1__VilA42QuZvrCuOzQG7pKYgdpPotkS6yJiqx11hRH826z3Afgaf7eqxd0k9Tjjic0v87JP1BLMTlV22uEXWF8gjThSDNwiPU7bU6id7CjWpMJ1KpZjYYDL_IDcncbZbtmUBYjXueu-FW_EFsoklL9ziB1UtUqEeIuMkC7sistUOzh88UDDnOd9I5a1fyGKpG6TeUxrvGnCwfDzXYfxcgsQCeZ8Kh8rlfjhYt7jr3t0dbzyl8ECDvwoFNHMF7jlwLJH0T1zEQB74wK8vD0nb9ocQyTycW2RCXJSjjufDlMZH-HpK6NTnaNnF5eZETekdYP0R0nhgSxp6YroJTRxoCPNKBXRNNwGBEWDRdSWYy1QzPrUmA9YIYf8F91JLv0h2e33mbb3hZNKsSm25Sl8OJeBRKWscYxph1m8bqPpfg5PUOGQN79Td72aKoKv5oZ79Bn8O5r8AF2VRSixuHHnfzw0nInYBKcpXza1FilUYnmZQJo9Qx8bO6M4qJd8zB2YotTMf7qHM0rPqR_L8jYUMoweMbdqnx6DR6EJMMA3k1ZLmV-2DdFPfy26PGmo0_mAMDW3JvhYfOq-J-bD5dDltudY7usnJVK-r3l74XxvDgD5BYUv6mHGA5wEpToD8w9i3jx8fvLhxW5si2PjdsVvvR-O9DJ1oOsVskaULORNz5jAVniVqLDdzKHcctHYQQEW6YlGQRt-k8z5xGhKvnKvYvr_U0oWrRTVxeDWm38IHpruUhWZKUwiCZQUJnGmkijCENC1coBqAKIONQb--ko5XH1BkocODBmq8Rk_xQMiQaykX4UNsYCItSWY0G40x2QAwU1y3RwOoQrMYsxXY5yxHJXN7n_0cbYxJGcYCxcjFZ9vZ5Gw20oaGq7TQ52xx5mptiKrV69Sm67spaeoVoSdKf_QwkvOSP8XSN2xJV07ADywoA9CflXBIkAYz2GH2O2eFrqc3w5A0o_bFmagelr_fN_jyAKL-7bgBBw_K5jg6SnytdMAYvcGZq5XsXmNeelGinSwR1aCc9v1-tRWUx88jYIL087-8Wt7zjCNl3U14usH-LjjEQzbQLstNlrfbELdmh_ExSnh8jlquoVQhjeDgHIfGe352T8rmQKt7m4KPi6RwPgPwys15EmZAg-boeorjZUyOck5lKb4YBX5L52iwY6hLnzUibPeBd4jlnU6SG6H6aDpsr4KxVaJz63RkkwLOUP0UFTbuyMtKR4-bDwPK2IhzJ-xi-5o1pyzkO5trV-hgteeu6ek0bzBBwfwN48a__Cs8cocRlVFZbVFFpG2UfHEMmWjSyF-MF2D9sBDLV2Moq54qaIr508jdYxg1uLDAT9kLBP2mysodavqvk6FhM-q2lnxhEFuENUNVZ3aX7Ck2sgA88hSE0AqKOEMOnoodTTR0DdRePRYiMhTCg8XLMEnm7fHPlKnGfca2FYEGFUeFut5za49NPGKz4xflUV8Fy9nU5ZYRrtN24LpUCZxc_fF9tTbEC3WsQa-FrDcpnjGkUzJmkbMqRX_yIB4CaYar5zv5S6h04MDfWx_omdg30etGDLomGBvqzHessNiUbY7ggObcbFbIGOMd6GwAuO9A4tmvdq7o_nkVqfbjhX3at3-MUmciAbmkgGp_vRqGIJ7-N6eFKEtaQJnfgOt8YTT2GNzIwKQet9LRLx2cd7NjnRv_tJIvHRE98fvoyiacAgUrMgwBlNIbjX8RsCj7efKNrRcP7dHMrT_EmvWdWw_tyHotF8MMAvWiD0t8DKpyNs5FdZwSmI32H65FzIgDEpsK_BC1xmtOjpUZauj69PazECc6Hwr1Mm9EqVMPMzBhZwQ4VR3xqL_iiOxeB0N1WXjZMQlYJ4HxxvKwl4BsFwGiXNr20GUr1W9A-YlN_fW2iA-4lYQHFjvaiC6R7TjTEFuREBsd-7OvgEL7NOwKVmwyP0wkK083WRx3sWmskxQ_oKc6O-pUKt0CrlQvXR3UMufQFI7Q7l7cHhIYViNc9hZb8q7CsIV6wgkQI6WVuDx8KxD5UOF9yGx7lb0-4IjzYmiJSIdOsoKODa2Po_sa5ZB0XqeHBsTE5TZlX0S6Q-jIAbx0GyO2d3_9XbbkxTPZfkF6-tDGIevhj7t-nZBIpNCCIOOrYHA69FAVu0BrXesS7pRu72dcPByZGH-OyTt-gSM&cid=CAASPeRoidFmDsyjOw8LHSIv_GZKu1lOmmWWzPU7Z5_oprc4AWakQziFWB6PAI21ymLAlAV2aMYukCkPg9Yg3xA&rfl=1%2Chttps%253A%252F%252Fglossy.espreso.co.rs%252F%240

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12d333e430d42638c7e6f25b1d18722464feabd97d10e321ba82f20644520b4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:42 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20676
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD70 42 B
498 B 77ms
38ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DqZr4j3OWvdGybFHCQk3D_P6a_3x0MzKq3ABRZNlcxrISJNjoFVOWrLdPOWV7YXglvNnSLy3SGVbEt2E6nhLsqA9da3x4R1ptFhKsFWeE_UQlKie4

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame AD70 2 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/window_focus_fy2019.js

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:22:24 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AD70 116 KB
35 KB 37ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc015126841eaa9b1b79ee123e13d7d07ad7fe77f22366b05c480eff59a7a25e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1619017370605640"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36032
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:42 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame AD70 13 KB
5 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

439ab67fa3c312bb442bed574ea79be834dbd92f3bd7d2288b6f3fce4d0afb0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5604
x-xss-protection: 0
server: cafe
etag: 2846967340006788112
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:21:50 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7194
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

41ms
40ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 26 Apr 2021 13:22:42 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 12029123908616896856
tpc.googlesyndication.com/simgad/ Frame 7194 77 KB
77 KB 16ms
14ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12029123908616896856?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4ql4hDUsJ6r1jdEGRh8Ffn4s0RK3vA

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae530631222f885227d5eb22e80ead92d518178c9e18357ebb9d0fee47d8369b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 22 Apr 2021 07:20:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 03 Feb 2020 11:08:28 GMT
server: sffe
age: 367340
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78527
x-xss-protection: 0
expires: Fri, 22 Apr 2022 07:20:22 GMT

GET
H3-29 200 sr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7194 3 KB
3 KB 7ms
6ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/sr.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

740981e13ae6d521bd5893d76539e47822919cdf4f1a99841b3d9e5e16b9497f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 04:17:50 GMT
x-content-type-options: nosniff
server: cafe
age: 32692
etag: 114314232294822369
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2855
x-xss-protection: 0
expires: Tue, 27 Apr 2021 04:17:50 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 7194 344 B
368 B 8ms
7ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Apr 2021 21:00:17 GMT
x-content-type-options: nosniff
server: cafe
age: 58945
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Mon, 26 Apr 2021 21:00:17 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame B90B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

41ms
41ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 26 Apr 2021 13:22:42 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 8 KB
3 KB 9ms
9ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Requested by

Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc2a3c053597c6bf22f3a301faea5c6b78364994eb74e4e75493a7ec9a0e4d12

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2722
date: Thu, 22 Apr 2021 23:42:15 GMT
expires: Fri, 22 Apr 2022 23:42:15 GMT
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 308427
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D851 0
0 84ms
83ms Fetch
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CIi2Tob6GYJOXLY2zx_APuqCCoAaWls-aYu_L5rq0De22iuegCxABIPPwpEZg6eTJhdgaoAGjrMHHA8gBCakCCh3w4LdPtD7gAgCoAwHIAwiqBOgBT9C5haMwyVC4cM9AG7kefQ26772yv9-LYzAz83FydRhL-TV8-9ae0-7FcV_FbKVAdO7ffY4od3-pTG9Af3PTeqkRmBrtBhJDGdYrnQ1Bdq-_KlKF-9-Lv6bhY7coPAjkf8DQSEO32IktbiH1vND8pDid9P7hGp3d3wRoABSpRs14x4k9or8kGaIbV0o7zOba7PDg2cSVjcThrmtYO7mb6GTMqE0dRQ-CkW39HNLVwpRngr5YM2cRleahou8iAINQEb0_j49wNiFeJdYmSHuu-cPksjmdHLEo2i9OwduKVcUsetDwaRd4cMAExaP756IC4AQBkgUECAQYAZIFBAgFGASgBi6AB8XTvjioB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQ9sMB0ggJCIDhgFAQARgdgAoDyAsB2BMCshcaChgIABIUcHViLTYyMDkxNTU3ODE1NDEwNzQ&sigh=8iMNJ1Me2Uk&template_id=419
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/ Frame D851 17 KB
7 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/abg_lite_fy2019.js

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9f3358441fb5f83ee3575f81df787bbade8b416b009cbdcbd3b71c8b6f560e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:20:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7028
x-xss-protection: 0
server: cafe
etag: 3134275839577271762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:20:32 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame D851 2 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/window_focus_fy2019.js

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:22:24 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D851 116 KB
35 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc015126841eaa9b1b79ee123e13d7d07ad7fe77f22366b05c480eff59a7a25e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1619017370605640"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36032
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:42 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame D851 13 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

439ab67fa3c312bb442bed574ea79be834dbd92f3bd7d2288b6f3fce4d0afb0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5604
x-xss-protection: 0
server: cafe
etag: 2846967340006788112
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:21:50 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210422/r20110914/ Frame AD70 22 KB
8 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210422/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ae7oyD61oqjUPvDcIwwBBvgN8Hf2zodhoz95shq4dTQE5IX9NVdAqitHk0D3aUwR8aFnv4DMeE6APZT4hiEswTQCuTKTk9WpAPkHjBtAkGLth2rpbrDASRRhqPzaiUHevTqQCr_eh6sHC5b_JBqk3taHwV5A&dbm_d=AKAmf-D7SqZR8kRxk7MK3NbO0MwKoh0eVsbfrTeBSeCy0sx1KJnr1aHPsXWe0bxuZKskFh1Daxr4W7n6Jc3e2gcQ9D6TCOyb5_2gYUqqlZGipKAsex2G3vW2cgZuWZt_MZOvFIT4heKmcm5GIEa2W24nSrFG2GYCSV5R8UfFMrTdvUFAcSyPSSR-tJLnJFjRkX9QeZnkZQsoBZty_SMiZng-M87DFMdA4iGPrlDPDuF31uBIbPdtb720h9eNm8jDE4E0dQMpszsWgFaG6KN2KqKxHFon4aaRQs0B1H3eQK1aLEHvmV41Ql5d5CeOvH2Gc22g9jiZ1IztZcY8xG3Xq3CWcz9M0MUrBJ4IcprQmsBS17IptPjtB8RMZvu4MyHLKw19n3B_NBtjl0BVJpbI9FW56kawtb1P24Pl2lownyqKbojdn-tlbebb2efmCeiZTJ-ZbvQazuINmjLCaI8g-_D6pNQFXf46IKYs4-9bN34jWFRjEDfHHTAuNjxw5WNb3uOTtKX3TTcKT6A3K2D96QeTBqEjvbk9jDWVAE-dlOvvWYZZ_ca0vRGBCeYgGOm2nzqdz9XZuDA_kARsW-K_FTnUxMqJNdXZBdQ5kZtHnsBi8Hwqu-Gv2OmU3hbqvwas_cGVeO8s2WwY4sCp5b0FBNhun08YGGQO7DDMLGb7LouUderKjNZc1xSbsBR8Xs2Ay4AFgNDmAGwLSL_e7rbOZb5CcKzGntB5FEicyRbXYYH_vDeiub5H-qXBalCD0bwCS917hOd2Z-Uy9Mtz5vg3Oa3Z5kfGXmMeg-kZPXuTFHxHeLGOdT1dVz9Nxjfrp1QIPRbwnUi0GAWxzulAOequEB40rKKzIB3U_2cGou-JlfPr_J9vnl-SBuu-5g8unGFmGaVColaS4Qx_3H0UtCfe0s_i-lfFnLF3MwF5daWoZI6yM8ULDbmcUJp1__VilA42QuZvrCuOzQG7pKYgdpPotkS6yJiqx11hRH826z3Afgaf7eqxd0k9Tjjic0v87JP1BLMTlV22uEXWF8gjThSDNwiPU7bU6id7CjWpMJ1KpZjYYDL_IDcncbZbtmUBYjXueu-FW_EFsoklL9ziB1UtUqEeIuMkC7sistUOzh88UDDnOd9I5a1fyGKpG6TeUxrvGnCwfDzXYfxcgsQCeZ8Kh8rlfjhYt7jr3t0dbzyl8ECDvwoFNHMF7jlwLJH0T1zEQB74wK8vD0nb9ocQyTycW2RCXJSjjufDlMZH-HpK6NTnaNnF5eZETekdYP0R0nhgSxp6YroJTRxoCPNKBXRNNwGBEWDRdSWYy1QzPrUmA9YIYf8F91JLv0h2e33mbb3hZNKsSm25Sl8OJeBRKWscYxph1m8bqPpfg5PUOGQN79Td72aKoKv5oZ79Bn8O5r8AF2VRSixuHHnfzw0nInYBKcpXza1FilUYnmZQJo9Qx8bO6M4qJd8zB2YotTMf7qHM0rPqR_L8jYUMoweMbdqnx6DR6EJMMA3k1ZLmV-2DdFPfy26PGmo0_mAMDW3JvhYfOq-J-bD5dDltudY7usnJVK-r3l74XxvDgD5BYUv6mHGA5wEpToD8w9i3jx8fvLhxW5si2PjdsVvvR-O9DJ1oOsVskaULORNz5jAVniVqLDdzKHcctHYQQEW6YlGQRt-k8z5xGhKvnKvYvr_U0oWrRTVxeDWm38IHpruUhWZKUwiCZQUJnGmkijCENC1coBqAKIONQb--ko5XH1BkocODBmq8Rk_xQMiQaykX4UNsYCItSWY0G40x2QAwU1y3RwOoQrMYsxXY5yxHJXN7n_0cbYxJGcYCxcjFZ9vZ5Gw20oaGq7TQ52xx5mptiKrV69Sm67spaeoVoSdKf_QwkvOSP8XSN2xJV07ADywoA9CflXBIkAYz2GH2O2eFrqc3w5A0o_bFmagelr_fN_jyAKL-7bgBBw_K5jg6SnytdMAYvcGZq5XsXmNeelGinSwR1aCc9v1-tRWUx88jYIL087-8Wt7zjCNl3U14usH-LjjEQzbQLstNlrfbELdmh_ExSnh8jlquoVQhjeDgHIfGe352T8rmQKt7m4KPi6RwPgPwys15EmZAg-boeorjZUyOck5lKb4YBX5L52iwY6hLnzUibPeBd4jlnU6SG6H6aDpsr4KxVaJz63RkkwLOUP0UFTbuyMtKR4-bDwPK2IhzJ-xi-5o1pyzkO5trV-hgteeu6ek0bzBBwfwN48a__Cs8cocRlVFZbVFFpG2UfHEMmWjSyF-MF2D9sBDLV2Moq54qaIr508jdYxg1uLDAT9kLBP2mysodavqvk6FhM-q2lnxhEFuENUNVZ3aX7Ck2sgA88hSE0AqKOEMOnoodTTR0DdRePRYiMhTCg8XLMEnm7fHPlKnGfca2FYEGFUeFut5za49NPGKz4xflUV8Fy9nU5ZYRrtN24LpUCZxc_fF9tTbEC3WsQa-FrDcpnjGkUzJmkbMqRX_yIB4CaYar5zv5S6h04MDfWx_omdg30etGDLomGBvqzHessNiUbY7ggObcbFbIGOMd6GwAuO9A4tmvdq7o_nkVqfbjhX3at3-MUmciAbmkgGp_vRqGIJ7-N6eFKEtaQJnfgOt8YTT2GNzIwKQet9LRLx2cd7NjnRv_tJIvHRE98fvoyiacAgUrMgwBlNIbjX8RsCj7efKNrRcP7dHMrT_EmvWdWw_tyHotF8MMAvWiD0t8DKpyNs5FdZwSmI32H65FzIgDEpsK_BC1xmtOjpUZauj69PazECc6Hwr1Mm9EqVMPMzBhZwQ4VR3xqL_iiOxeB0N1WXjZMQlYJ4HxxvKwl4BsFwGiXNr20GUr1W9A-YlN_fW2iA-4lYQHFjvaiC6R7TjTEFuREBsd-7OvgEL7NOwKVmwyP0wkK083WRx3sWmskxQ_oKc6O-pUKt0CrlQvXR3UMufQFI7Q7l7cHhIYViNc9hZb8q7CsIV6wgkQI6WVuDx8KxD5UOF9yGx7lb0-4IjzYmiJSIdOsoKODa2Po_sa5ZB0XqeHBsTE5TZlX0S6Q-jIAbx0GyO2d3_9XbbkxTPZfkF6-tDGIevhj7t-nZBIpNCCIOOrYHA69FAVu0BrXesS7pRu72dcPByZGH-OyTt-gSM&cid=CAASPeRoidFmDsyjOw8LHSIv_GZKu1lOmmWWzPU7Z5_oprc4AWakQziFWB6PAI21ymLAlAV2aMYukCkPg9Yg3xA&rfl=1%2Chttps%253A%252F%252Fglossy.espreso.co.rs%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8a2b3462c740c8347f2e5db24143b43e7cfd0adfae2f65f3ae30254985a300e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:19:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8608
x-xss-protection: 0
server: cafe
etag: 8606185217770904955
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:19:14 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210422/r20110914/elements/html/ Frame AD70 8 KB
3 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210422/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:18:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 May 2021 13:18:56 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AD70 0
575 B 195ms
92ms Ping
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsshqCXC5qnc0rNOxpqgYtMUOSoHYvJLLXcJVMz49plGmWfxj5jLzhHWsSh-_hj0SknwFmTnKuTCm_wetjSD8s4HjXQ0jWiKnjjDNzMOOl6crNfQwLRb-QOzPThydJ2gdJBD1O-vbW2P26Yf8d7FnHHi4A2UvZx7ZmES2ER-wHVd35jyJnFd-UtNrCTl_HDZcHc4i91Pom8kUwyETsnOqsT3Tx-oqMHt8Do4rRIzp7yUIxNHtI05TzqudCCpbopkOn5Pr7aZrFInAPujUIARPeRTufGd1doe6V2pnn1eYvUDrCb-SF7D_ps9F-y0Ho5kOMCZ56vYoGM_rZX4QLQQZRP24dnA74LNkv1hYEU5WlXL3ukd7f7i9Yh53YGWxk3r-FvjiJJk9s_dv1ZLG8BygyKZ-aqXggA1Yb1OSyl3h1ZUKc_bv_KbdObre4E5c6T-9yD8b2SEm_qztguKYP4LM0ZMU7ilBzoNV_OUcnf3cF8sxWt2NFa_9c1rQHx2pms8D7_E5fqi9KX78YnEvkUi3BjYfRnBQ0KsQuyT9Ly-y0OmAYQ13fZMEdasnSYF6w6JlV-G_Yn_ETU6JseRjEibkkbotFTLhHxvrY_0Uzyc2cmbn9KmrNC7_1cxGdpN9rgkVV92OKeaTjlJMmvUOiGVPUKVqMnZn6Kbfm2EefG7rcac1UIRkeFJswjE8YBdgDDsO0o7ouyATLS-VfuPiDxUUsWjCDNCjBfDtYo8q6jGA47clH7OB412Mr0fCdF0pqjvbNmS5eBcMpquE682nzcD5-5IbgUDD0lYP8vX5IQj6TUSKZFZxoXl44m8y2k62ihuWf2t5DD6PjVkENmwCGX4yA_vGWCkgy4rdLkobOExYKL92BwXI5ga-lKVYMjF3jkPfwtPXWW2S60w-A0ZrWPvsbu0WwnMKTjw06OfyRkas883ilvsaHUqxYgqu3pLTZpLOYdDzde10yvkRmMYFvz_-WRrX8k5dI2HAG4-fU7ibiOAmMi4oYdrfHVjrg1bjPi5KIfDg3KIW-ou3l6AQUq-CufmYmu4T4pEh9jLZ14OENlPv_Op46ZBWJ-dqOrT2_Or1Ouwg8mwbBUs7wTj3AvJVqN7-KKEG-Gbc1s7P0AETAV9O53yUQAGn4dUIDGyfneKLBS8tLKzZym3kliEvge0cYRFMB2PTAfkg-Z3E3A0JoVYYQh0KNft9U6ruOaNCxoyROWqLyrcrFhnh8baUA-OfqqexLpJ5NgcKzbHxW32VZFtul5Az2ITOw&sai=AMfl-YRIDgD1l8Do72L5R4IBCWXLX2TEQ5ZnEkrRoSC315APNaFv0X5IWvwsqfsx__Vf5Ob-NOwZMpIZlcl9pRF4rd1ade-J4jVpdfTu71G1_sOpx5a-1dci3vdC1r4ersFwTrRDsXLInByZ0Mzpr1tXsA5IuyDTQPUZ9DT8THHJ9sEgQU1U1aB-0n1q_t1JhRBaI5jNiwQEfDZfFug70ByLvjcMtenMPvqOE9Mf27UL_iul8MPlYBJu1duMHGZcbVV-Ag&sig=Cg0ArKJSzLMzDZY4KoVIEAE&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210422.32969&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 26 Apr 2021 13:22:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AD70 41 KB
15 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 21 Apr 2021 06:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 458177
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Apr 2022 06:06:25 GMT

GET
H2 200 SS2021_DV360_ss21_damskie_v2_970x250_20210301.gif
s0.2mdn.net/9259447/ Frame AD70 98 KB
99 KB 42ms
16ms Image
image/gif 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9259447/SS2021_DV360_ss21_damskie_v2_970x250_20210301.gif

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

abbf7855a802f0084e6549e0db0c18d792f000d0489656fb181812c8eef390c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Apr 2021 13:33:36 GMT
x-content-type-options: nosniff
last-modified: Tue, 06 Apr 2021 09:44:38 GMT
server: sffe
age: 85746
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100560
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:33:36 GMT

GET
H3-29 200 16228630824492167325
tpc.googlesyndication.com/simgad/ Frame B90B 34 KB
34 KB 10ms
6ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16228630824492167325?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnfFmoMtiHjhfBRpnoJSL7GNh7WTQ

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

910735c361158050b45c59642209beefb43d2665dc774e627fe6d3c2365cf661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 23:24:34 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 08:06:20 GMT
server: sffe
age: 482288
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34550
x-xss-protection: 0
expires: Wed, 20 Apr 2022 23:24:34 GMT

GET
H3-29 200 sr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame B90B 3 KB
3 KB 9ms
7ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/sr.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

740981e13ae6d521bd5893d76539e47822919cdf4f1a99841b3d9e5e16b9497f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 04:17:50 GMT
x-content-type-options: nosniff
server: cafe
age: 32692
etag: 114314232294822369
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2855
x-xss-protection: 0
expires: Tue, 27 Apr 2021 04:17:50 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame B90B 344 B
368 B 9ms
7ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Apr 2021 21:00:17 GMT
x-content-type-options: nosniff
server: cafe
age: 58945
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Mon, 26 Apr 2021 21:00:17 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A2DC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1

43 B
1014 B

109ms
52ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Apr 2021 13:22:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 26 Apr 2021 13:22:43 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A2DC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YIa.ohdvTjfM2vzhOmkCgwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1&google_hm=2

43 B
1014 B

58ms
54ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Apr 2021 13:22:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 26 Apr 2021 13:22:43 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELBemnRVXsxv6-V_xSWx0Kc&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A2DC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAhvwNZPpLw6KusU9hyH3dA&google_cver=1

43 B
1018 B

150ms
50ms

Image
image/gif

185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAhvwNZPpLw6KusU9hyH3dA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJuhcRCmg7ECGIexx6MBMAE&v=APEucNWKIrHludd1acvWyXpARzeTYtLzsg6M4cDm59AACwO2jbR3cWNQXjdIGYXLzItYMd-Ba7MvajgAT9ASNbcTnuWRhetiuePwndaatyfssT5k2C3uu8tsrtk6hV2i_7b_zymN-1mdaWSqo2D4V6BIL6-37ejSqBjpxcA77F4_1rOYDHsxVXskPkxkSGYtajJ-TvxE849IltttkCNrJqmDRzj0OU4teg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Apr 2021 13:22:43 GMT
X-Proxy-Origin: 217.138.209.52; 217.138.209.52; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.234:80
AN-X-Request-Uuid: 5ce18fe2-dcdb-49dc-a005-477fd83bd194
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAhvwNZPpLw6KusU9hyH3dA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A2DC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU3OTIwOTc5ODQ4Nzg2Nzk5NQ%3D%3D

170 B
188 B

60ms
60ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU3OTIwOTc5ODQ4Nzg2Nzk5NQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 26 Apr 2021 13:22:42 GMT
X-Proxy-Origin: 217.138.209.52; 217.138.209.52; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.37:80
AN-X-Request-Uuid: 1a0f69bb-b7b4-4a76-b269-3f4e95ebde52
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU3OTIwOTc5ODQ4Nzg2Nzk5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E592 22 KB
8 KB 10ms
9ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 26 Apr 2021 11:23:04 GMT
expires: Tue, 26 Apr 2022 11:23:04 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 7178
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame A9E4 9 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Apr 2021 23:34:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 26 Apr 2021 23:34:05 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame A9E4 22 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Apr 2021 23:11:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8867
x-xss-protection: 0
server: cafe
etag: 18043545750443934562
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 26 Apr 2021 23:11:01 GMT

GET
H3-29 200 font.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 46 KB
35 KB 8ms
8ms Stylesheet
text/css 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/font.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da96a171a34b9a285b390a0420dce56df11ccc00944a462f334a7eadbf4e8c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 489512
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35363
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
server: sffe
date: Tue, 20 Apr 2021 21:24:10 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 21:24:10 GMT

GET
H3-29 200 logo_d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 1 KB
1 KB 7ms
6ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/logo_d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d29ff1a0d107b4a6a4508c99edb4b7783e2813b98d0a999ac4fbce8915b1cd66

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 344855
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1450
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
server: sffe
date: Thu, 22 Apr 2021 13:35:07 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Apr 2022 13:35:07 GMT

GET
H3-29 200 tyre.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 18 KB
18 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/tyre.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

403ce493ecf2931dd201da704c4d572575f55d2d46b8e9eb21aeeb3efc93e698

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 484389
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18271
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
server: sffe
date: Tue, 20 Apr 2021 22:49:33 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 22:49:33 GMT

GET
H3-29 200 bg.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 34 KB
34 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/bg.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f32f380f75a96ef2fea37bcb46f1ae687cf395773dfdad0793daaf4011d372de

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 558099
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34572
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
server: sffe
date: Tue, 20 Apr 2021 02:21:03 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 02:21:03 GMT

GET
H3-29 200 logo_l.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/ Frame A9E4 1 KB
1 KB 10ms
9ms Image
image/png 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/logo_l.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16233971882635096711/nt_s21-PL_728x90_nokian-wetproof-suv/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f714fe4238276cbacceb8400a76d9c33a9fb83e4abecdc52aebe8ee87772781

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 489779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1497
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 08:45:00 GMT
server: sffe
date: Tue, 20 Apr 2021 21:19:43 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Apr 2022 21:19:43 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6D1C 143 B
163 B 8ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnC0TMeAVx8GUNJoXDKKPU_enBajBuzdLzrrd1UcQqKLpxRxYnjAQ5a0nv_tgo; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 26 Apr 2021 12:56:55 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1547
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame D851 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a2f98a934fc514edfcf80af18d1e08598604d5a26173a0492900310de4fbb0f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame AD70 0
23 B 145ms
89ms Ping
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 13:22:42 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame AD70 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e294b1124af664a8b096c382966512ead1b7eb84dd4936651530e8d1d92e964

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A9E4 34 KB
34 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e7ba7486df51b247d667ddfef156c72ed4f149a3693b1ca9be424f2ea680a50

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H3-29 200 wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js Show response
pagead2.googlesyndication.com/bg/ Frame E592 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 12:37:23 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 2719
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5710
x-xss-protection: 0
expires: Tue, 26 Apr 2022 12:37:23 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6D1C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
URL: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnC0TMeAVx8GUNJoXDKKPU_enBajBuzdLzrrd1UcQqKLpxRxYnjAQ5a0nv_tgo; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 26 Apr 2021 13:22:43 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 26-Apr-2021 14:22:43 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 26 Apr 2021 13:22:43 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 26 Apr 2021 13:22:42 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 36 KB
14 KB 121ms
41ms Script
application/x-javascript 2600:9000:20c8:8e00:18:1fcd:34e:d2a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: glossy.espreso.co.rs
URL: https://glossy.espreso.co.rs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:8e00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Apr 2021 16:18:05 GMT
content-encoding: gzip
last-modified: Fri, 02 Apr 2021 00:04:46 GMT
server: nginx
age: 75878
etag: W/"60665f9e-8e96"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 0645caa18be2b3be5e4612d40f45a0ba.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: MAD50-C1
x-amz-cf-id: yBM-Tspmp96t6y0ncPY2miTrrE3YJ_swDPx101G2GxVJjI5u0wByzA==
expires: Mon, 26 Apr 2021 16:18:05 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 9 KB
7 KB 33ms
19ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021042001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d364136fa789eeb9f9ccda346ff9b8ed8bf92f52a234a25d58b1242f1773398

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Apr 2021 13:22:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6934
x-xss-protection: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E592 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BE1Hfor6GYKfEHr6LjuwP-r6VYAAAAAA4AeAEAg&bg=!EBOlE1fNAAZUuIlwVLg7ACkAdvg8WljJG1agjnfqhP5rkHgBrPiVHzStxkdL_9sFmNA0_8oL8EUqPwIAAADnUgAAAAtoAQcKABczaitcjt26l6xHrFuxqQmh9EPaq-6vAJkCejVHRPhB6g3_BkmzXjoPu3km3T92uJX544_TTsVNDzwytYk2De7JAT9WUMc-Juu-G7gB5ugPCZH0n2rO5dO6FPZtb5pYvvvxe3lLgkCn0kPxs05eL_-AG_0lQxTo4Ee6zB8Qtm5nHhntZFzYu_aetWtgnDNcz-gM9DKNsX1-qbzlBPWu_xByQWyxwcqdn-aSc5VKL1jDtkLCQOsI6sjthS7sdt5V4e9SgGonwte3iW4eJgH9kbg4Km6NlpipASyQIBdTHoE603hn_EO-x1yzjT9sk4kg6EanHPnPkUTg9fvOcxXEhiVd55fbvnEurj8CrC329meklxGLsoKV4gCJs5yxqFCZRmXWljGMfNaaaZamlz9oqtTKqAL56SdeecR5ndHazSSPKT-15qKf5-_YrAm-3VPg3-Hf_gk0zHyPkzyVdevvnfti8kFQ9pQiuI4Ot3z2_3U7fRYK9OIqFddWXRXjt8fWYP4fJJXCy1xQamLWKSDINMqywFCKaJ-s9Z06Q0PUA8meE1diKP_bbWESBk9Np34HYjDtIxwG4ExLVU5JIoacGjkeX9cpuXRqUd0taUbsTcGBmOXZ-_N3hjKnBSFhCIfcK-vVk692ZzEi6T3N2EUtz8RqsyGlbF527WyzGH0zEd0EG41GirkIaFMueLqpe6W_PVa-2X-9ZKymPFukWLPgrxu39zd-w9_URIkBGbhB9j77Jl4JQvj7XdGz-z6WqXgtN7H17iWAlRwpyp7vpEKnwuuNPRUgtwvzQJnJtQABpIieydG7anDNS7FyjhAolfz838_Vn6f_kRU1JEXy8h0uHnlZb_vH8gVN8JUhpFndQrbe3j-1mSs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021042001.js?31060870

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 13:22:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Mon, 26 Apr 2021 13:22:43 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame BF4F 12 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://glossy.espreso.co.rs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://glossy.espreso.co.rs/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Mon, 26 Apr 2021 13:19:07 GMT
expires: Tue, 26 Apr 2022 13:19:07 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 216
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js Show response
pagead2.googlesyndication.com/bg/ Frame BF4F 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Apr 2021 12:37:23 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 09:18:00 GMT
server: sffe
age: 2720
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5710
x-xss-protection: 0
expires: Tue, 26 Apr 2022 12:37:23 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
169 B 412ms
136ms Image
image/gif 18.235.239.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=glossy.espreso.co.rs&p=%2F&u=CNCcHZCnwHz-KsW64&d=glossy.espreso.co.rs&g=54177&g0=No%20Section&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=11869&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=3325&t=Bia9CVDsq07GC0NorbBf0p70BS-zp4&V=126&i=Glossy&tz=-120&sn=1&sv=Dy3CZlC8OypQCfNLWoCBWWKuCyq7Fw&sd=1&im=067b2ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.235.239.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021042001&jk=1050904863290207&bg=!8POl87fNAAZUuIlwVLg7ACkAdvg8Wk7AnpxfUcloOPqUHdFku2Q-fK9BVoU0trMtoznV6tVmYLNUiQIAAACgUgAAABloAQcKADj19AQ7w0ZGBjBIJTROa7VnIWNYNk_pQTv1xL2_xwafbIho4JhV6slWdZWmY6-6PLSjX8IAq-pZcZkCKdg89sKzHSTqBKqDvhJg-CStqJgmkFv_CDHQ_LYPRcZKHlhD7L6d88yKnhqBWM5c4r1f0aoe0mncL16D9SGrFThSC0L_p3YnGagJVeHfAZyFYuVdVWv8FQ79D4Di2pqPrsX--qs6Q5_L6cYC8WEZQVfUb9pL3Jsn0cUCfwZ7GJZWx065rwkzAEsnDscNTsHMbQAEGmhWVX0678p2640bWjt_uTiyGRXJlbfFF0k6AG_Gh2CIxblHfnWfASIUNBQBJa23cFM0cjkOsVSIkPsLfoiOmEULvP-cUvrhk42-bdY0294255sjSHu3GSh2aQZjsMv8IQi21Vb3P0wReuWNN7y6UaxSlb4pt5EVkerpezYsYEwy09Jkjs9Duj0dSnNsdnuGU43awlVjDpVE-okkkGxoSZ9IzeMif6LKdNebanNNTRgqYVBiIfFNl4OFRbhMkSTqMxEvUSBH2LQQmY3zlYDBhJ9cCBKA5WO54y2b8Ej5B-U-LL-YEZquyufqj5OqqWs1LqD80eKWoOCLZXb5ranbiNkUr6zwNfHM8wJxB5Vp8kF2ssiSZ3bEvIvdXzuxrvfa7uiYBIj1cD8R4k7lL6IgEvYn7bDbuKfgFVpIjD0z9QN4Ufx0ytb9XpF9SRTvdiiq9nYRe9EbLIPX6YlDgr8J2CDAA-u8YL4wVI2zLc6FEzhOJ36SdHoyOqBBY-r8ynwxOWol2pcbY-VpU7Q_XKx6dezOO5-lzlU

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7194 42 B
64 B 48ms
46ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstKqveT5jAItsOQpnlrx1PL3h06oADHIFzzPk82rUFhP4rj5SwVWw5U4b70t4rKZUWtnLguqR4DkFgmm4iMzt9XE92FfeILOEMYs3u1bzXluVAxALwvWGdMLcefFlsrad0tZYnyKqCqB-QkQ7ZHUTb-&sai=AMfl-YQ7lo8BaLBFr1NMr9SNY2bZSsBKkgNMghsj4128gVD0aGtN1NrgcJ6VL_Xo77aZ2tRRNwXmjWu6Fct-EGXldZ0qS564bpefcjd7sx2qv8x0fpH1XlKRczB7_F0RUT0&sig=Cg0ArKJSzGytJ7uBCE-mEAE&cid=CAASPeRofA1jWkmX5QhnTAHkk5yqxaCfesx3Z-Gf9_0MX8mYzCWZM11WTHv98GQ69E_al4EqIc9VBw77qTYnwEI&id=ampim&o=980,590&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=245&tls=1245&g=100&h=100&tt=1245&r=v&avms=ampa&adk=437793788

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://glossy.espreso.co.rs/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AD70 42 B
64 B 17ms
17ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu3HEfVdY1n00wPM_-82pSalYcAKdDBpJmc9ivaAvkIo-19l7A93yxHJLjSJUB8wq0wUj82EXSCBpBQXGNjHRP4-Y_3nHpDkyrzkcrE5ZBGrXzylx4rk7qWvdAP7A&sai=AMfl-YRGpYhs1LC8tqKLVZYmzNXVe-7coNn8igx0fos6Vv7ZbhSDUNiL51-Xf0_KiefeK3yLB73nuSFk1Cxy7bSaRiHBiWrMfWNE9k5dUlZ_se4ZSxGhHc4A3Ip-YrwNuIs&sig=Cg0ArKJSzL_zzVOXrYRDEAE&cid=CAASPeRoidFmDsyjOw8LHSIv_GZKu1lOmmWWzPU7Z5_oprc4AWakQziFWB6PAI21ymLAlAV2aMYukCkPg9Yg3xA&id=lidar2&mcvt=1000&p=210,320,464,1290&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210421&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2049153674&rs=4&met=mue&la=1&cr=0&osd=1&vs=4&rst=1619443362354&dlt=72&rpt=561&isd=0&msd=0&r=v&fum=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D851 42 B
64 B 25ms
25ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstndou_SNO_3kbsRyNyYeR3hXnF2gZsX7WlZLKsGR7FxeiO0P5fVKY5niFSOAUipNYIx-hoUmfIqi5_rnuIlniZN1kq3KjMH41QoBbsoXGcp6IJFCuixAKOK52bCM41DwwcQwsG3-4GU9_EMpJG2MpO&sai=AMfl-YT4zrRte-z4cghWki7s2rZ5smcQETYHcWKvjKaakjo3yB6PD5oFraHHMJI5AUts_akdqjn05w05hIxA59xhh00W1ZeUfqrsY5tSQQ1dVjrRWnYqQYZoBYxxnq7blMM&sig=Cg0ArKJSzFz1WwV1XeHoEAE&cid=CAASPeRoCu2UdFi5SiOM8AIZLyWClsJQ5QAi7iV_P2EkicG5dFq0kYsaH-GTBpLcjKQZ-CjgXBe-RnuiVAjO_RI&id=lidar2&mcvt=1003&p=15,552,105,1280&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20210421&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=2341537960&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1619443362411&dlt=98&rpt=58&isd=0&msd=0&r=v&fum=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Apr 2021 13:22:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

214 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 17:50:46	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 03:12:19	Name: IDE Value: AHWqTUnC0TMeAVx8GUNJoXDKKPU_enBajBuzdLzrrd1UcQqKLpxRxYnjAQ5a0nv_tgo
glossy.espreso.co.rs/	1970-01-19 17:50:45	Name: _cb_svref Value: null
glossy.espreso.co.rs/	1970-01-20 03:19:31	Name: _chartbeat2 Value: .1619443363361.1619443363361.1.Dy3CZlC8OypQCfNLWoCBWWKuCyq7Fw.1
glossy.espreso.co.rs/	1970-01-20 03:19:31	Name: _cb Value: CNCcHZCnwHz-KsW64
glossy.espreso.co.rs/	1970-01-20 03:19:31	Name: _cb_ls Value: 1
.espreso.co.rs/	1970-01-20 03:12:19	Name: __gads Value: ID=21d9be09a4994e0d-22046bb0f1c700e1:T=1619443361:S=ALNI_MaIo1bYGvDD1RbRTg9kpTulz09Ylw

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=www.espreso.co.rs(Line 1) Message: TypeError: Cannot read property 'getItem' of null
console-api	error	URL: https://static.cleverpush.com/channel/loader/kTvC4RTe5ySLedKnR.js(Line 2) Message: TypeError: Cannot read property 'getItem' of null
console-api	info	URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2103020108001 https://glossy.espreso.co.rs/
console-api	info	URL: https://cdn.ampproject.org/rtv/012103020108001/amp4ads-v0.mjs(Line 10) Message: Powered by AMP ⚡ HTML – Version 2103020108001 https://glossy.espreso.co.rs/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adrs.hit.gemius.pl
adservice.google.com
adservice.google.de
alt.adocean.pl
alt.hudb.pl
cdn.ampproject.org
cm.g.doubleclick.net
connect.facebook.net
dsum-sec.casalemedia.com
fa45b152035dc4ec73793f4ae575b6cb.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
gars.hit.gemius.pl
glossy.espreso.co.rs
glossy.espreso.rs
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.quantcount.com
pym.nprapps.org
quantcast.mgr.consensu.org
rs.adocean.pl
rs.hit.gemius.pl
rules.quantcount.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
static.chartbeat.com
static.cleverpush.com
stats.g.doubleclick.net
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.kurir.rs
13.224.193.118
137.74.0.158
142.250.186.162
142.250.186.66
172.217.16.130
18.235.239.192
184.30.24.241
185.33.221.52
185.80.68.6
2600:9000:20c8:8e00:18:1fcd:34e:d2a1
2600:9000:20c8:9c00:9:46dc:4700:93a1
2600:9000:20c8:f200:6:44e3:f8c0:93a1
2606:4700:20::681a:f1f
2620:116:800d:21:36a9:ecb:e518:b308
2a00:1450:4001:803::2001
2a00:1450:4001:803::200a
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2006
2a00:1450:4001:811::2004
2a00:1450:4001:813::2001
2a00:1450:4001:813::2002
2a00:1450:4001:827::2001
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2002
2a00:1450:400c:c0c::9b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
51.159.89.0
54.38.63.93
87.237.206.234
87.237.206.235
00c386d44ee97982b7afa31aa58529acbb575edb8f5d2352f0c7c3dff5597e84
03b4bcbb92f06b59938e69d4acff3affaa6f1b4710cd752d163b2a74146fa0c2
047ed5c1bcaea807f1edb61af9be9d808c474d7ae00dd2577067ad4adbcffd29
0ae5ed57dc48abbee125d5f915e37110c9f2bb6a95d1aa5ccf3c141f8fe10db3
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12d333e430d42638c7e6f25b1d18722464feabd97d10e321ba82f20644520b4e
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1e7ba7486df51b247d667ddfef156c72ed4f149a3693b1ca9be424f2ea680a50
1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3
21d45a4ed77653b3b1ee2b47a786a4dbb936a3b19fc56e1b44c16aed35eb80ee
22882a69a2cd613b25bc774dded2d9d71c97bf0677d764e8bd270402a6802688
273c6cb3871ed1aa5ca95cbcea10b5b1d54b2ce529a4f210b4837b9212bab215
288408f94c8544316dfcb09ef48ffc118d5498b80953c36318482a5ddffcfdf2
29507fd3a172d0d54a23c53defa95fe78dbf477c5577b7b789abc2946c8a40d8
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
331ef5ae0fc9f67d983660c7b39fde19c53be46c167a6fa058f6e42ce3668ea4
39e110d013cee5277b6be02ea51c5b08319dd79697aa19bd2a191f47d7ca26fb
3d05476160b2e6ab3b268c139f71dcd960449aae386a6b7c7ba330f22f3a12de
3d364136fa789eeb9f9ccda346ff9b8ed8bf92f52a234a25d58b1242f1773398
3f6f9bf92a91e2f4b672896559da3642583af347fe3b771ad205011e567e4e50
403ce493ecf2931dd201da704c4d572575f55d2d46b8e9eb21aeeb3efc93e698
439ab67fa3c312bb442bed574ea79be834dbd92f3bd7d2288b6f3fce4d0afb0c
4410d5893c95822f69d5b732be82b6d44878ffc8d202e17eed0c5b47f9f4e38b
4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87
4956137c69656045c048a157aaa84859657bbc7744019d26cce6b5bded84cc49
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b740d8e668dff5a9fbbfa8712482f7176d4679cc1cff5f6c5a83654a062c1f6
4c6af60796cc240ad277098308cf363c2700f5296264ec1b43b4e1362763c439
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
64a392480eadf7c422883153ce5ef2d7035e85549f80365ec48fa87b98ffe2b6
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
6a2f98a934fc514edfcf80af18d1e08598604d5a26173a0492900310de4fbb0f
6cbdabe0f41b8533fc2e0e663541154462faa10eb63a8c7dfc7447e6a079ba7b
6e294b1124af664a8b096c382966512ead1b7eb84dd4936651530e8d1d92e964
6e553b4e88ac4a1819d608fe9dcb46544ca5fb776d4e0c84d773f37b1df18211
6fba8bf2989182b28478f3ac9b3d3cd8ce216c20bd3e1a518a2280eb013aab95
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
73543b3da479f12c64d510e6483c68283b8990da5888ac5df4f2cc93c669596b
740981e13ae6d521bd5893d76539e47822919cdf4f1a99841b3d9e5e16b9497f
747c62cccc8808468e268f1ca31fb38eacb3362e8a8c10b5b80b797b049e88b3
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
7cc569a18a9dfd7f191b5cf516e335c67255047ffbd4da0f1e8109598665ada8
7e31d2ba04a716769dc0792554ec863f94710055d55e184e00c061d7616856e0
7e4563071048dd98f7120d73d55aa8f31fef27b1c1cf600eb38306421078153d
8000d797097e74bfff377d2f3fca7e046ee4490ea4edb70c2c0b189575847629
82bba5218cd7c1085787943d23084963890411a3dbcd415e518eb498fafa45f4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85516914f05006889ec386568254f3f6793056f54ce0b02c9d5e8fbd137e223f
86ab03a72e25300a317a6a1e722eb5299b33aeac4d2c8c20ba769328bd90180b
8c5a62c74692dd5d707767c763842fa3a199c5d50b526f2a138747af21ba6202
8f9560479a05fb86854546c40ec030edc2bac692d4142391d69b16e5c033a185
910735c361158050b45c59642209beefb43d2665dc774e627fe6d3c2365cf661
95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
971263b0413ee5a5d404b27679aa956199c29bf413a8af6d977f2fdc32a5a0c9
9a2bde2930285c7818358ae512c16f7997642ca0a8407c917b88d8580821d01a
9bcc6c1e0e30ed82d985e163a32d30e2c111057303c3dbbe47c5f841db8e527f
9cad9b3c62dfa30964a1f0c1d01301156766fc1e5e1836f8819282a49b964ce6
9d41ade4e2e972e30e03396fe9a9a6533e9791f3a91913a89883911005715726
9f714fe4238276cbacceb8400a76d9c33a9fb83e4abecdc52aebe8ee87772781
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2aca9aa200ad3e4dd9afcd27fd2bd5b272a5d297e9f85d708394857ca6a1ffe
a32de0e80741978e7816c3639f2697f435e1c270c04c755c2367e1c2829a9d84
a3b80a61e36c2137618d9706a0c11604ff0e1a7cc5157130baf00d51a0062777
a4096ac8f0fd66170f9e70a2c9739e5e57585491f25b2ba93debde376d7c5b65
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6f768cbb894f2690011ee62662d3ac9480d12f5088fa46be57e650fcc4d835c
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a8a2b3462c740c8347f2e5db24143b43e7cfd0adfae2f65f3ae30254985a300e
a9332c448983466e12f379523fee262d67f6bc315fa2c0c174cb04b2aee67eec
abbf7855a802f0084e6549e0db0c18d792f000d0489656fb181812c8eef390c8
ae530631222f885227d5eb22e80ead92d518178c9e18357ebb9d0fee47d8369b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b7f736144a4c3c86a1e620f94d91b3c0eedcadac33888203e554dc2e7c3cfa66
ba462692b44ec826922965ea262e87e2fa936c82383982380b10b898444cf90f
bae2f4a1d2f8daad335303236aa79bf3626c6254ee7d3e0b4cabfd30dd004223
bc04165c9415d89ca2185d6f86d6244a627b78b65fba5ee6304cb54fe25e799d
bc2a3c053597c6bf22f3a301faea5c6b78364994eb74e4e75493a7ec9a0e4d12
be36bf0f2001beedfdeec85a65ee55b6b610f5466b59ca38c7a427c553f9195c
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
c4c5ec3f529c6f8f951120a229c1b1cd386dde12e4de0cea91cfabe367e57f36
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d29ff1a0d107b4a6a4508c99edb4b7783e2813b98d0a999ac4fbce8915b1cd66
d3eee9e4ebf3283e4e03867700f591840bb9f2d23ba4b957589b0f88381d28c9
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
da96a171a34b9a285b390a0420dce56df11ccc00944a462f334a7eadbf4e8c9c
dc015126841eaa9b1b79ee123e13d7d07ad7fe77f22366b05c480eff59a7a25e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e521da0465249a9e941cbbcc580b715b26607768d0b055c29c1de2778995e8d6
e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4
e9f3358441fb5f83ee3575f81df787bbade8b416b009cbdcbd3b71c8b6f560e0
ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab
f090227023cb717d36a8b88f36dd15225aebc4796d398c2625d2fa1743f3bf71
f29f5f43a67d089673cc57e4c2b7b86a27bdc695b21344f63e4c58abbc8d2ab4
f32f380f75a96ef2fea37bcb46f1ae687cf395773dfdad0793daaf4011d372de
ff3587135389fc0f7399474f84d6bff086059dbcb13d9b4e64b495d72ba4e4c7

glossy.espreso.co.rs Open in urlscan Pro 185.80.68.6 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

146 Requests

99 %HTTPS

62 %IPv6

27 Domains

39 Subdomains

35 IPs

7 Countries

7999 kBTransfer

10739 kBSize

7 Cookies

20 Outgoing links

Page URL History

Redirected requests

146 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

glossy.espreso.co.rs Open in urlscan Pro
185.80.68.6 Public Scan

Screenshot
Live screenshot

Full Image

146
Requests

99 %
HTTPS

62 %
IPv6

27
Domains

39
Subdomains

35
IPs

7
Countries

7999 kB
Transfer

10739 kB
Size

7
Cookies

146 HTTP transactions
5 data transactions