zaytung.com Open in urlscan Pro
213.128.72.10 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://zaytung.com/fotohaberdetay.asp?newsid=395636
Submission: On August 17 via manual (August 17th 2021, 5:58:07 pm UTC) from TR

Summary HTTP 443 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 66 IPs in 10 countries across 53 domains to perform 443 HTTP transactions. The main IP is 213.128.72.10, located in Turkey and belongs to RADORE, TR. The main domain is zaytung.com.

This is the only time zaytung.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
48	213.128.72.10 213.128.72.10	42926 (RADORE) (RADORE)
6	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
29	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
7	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	31.186.16.22 31.186.16.22	197720 (TURKTICAR...) (TURKTICARET-AS1)
7	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
39	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:4700::68... 2606:4700::6812:353	13335 (CLOUDFLAR...) (CLOUDFLARENET)
32	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
6	68.71.249.118 68.71.249.118	20093 (ZEROLAG) (ZEROLAG)
1 3	92.222.208.206 92.222.208.206	16276 (OVH) (OVH)
1 1	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2 9	92.222.252.172 92.222.252.172	16276 (OVH) (OVH)
1	142.250.185.230 142.250.185.230	15169 (GOOGLE) (GOOGLE)
52	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2004	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:830::2006	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f14... 2a03:2880:f145:82:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	37.157.5.73 37.157.5.73	198622 (ADFORM) (ADFORM)
5 10	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
2	2600:9000:210... 2600:9000:2104:7e00:5:c4ab:c3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4 8	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
2 2	185.33.221.52 185.33.221.52	29990 (ASN-APPNEX) (ASN-APPNEX)
3 3	185.64.190.79 185.64.190.79	62713 (AS-PUBMATIC) (AS-PUBMATIC)
6 36	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
1 2	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	185.64.190.81 185.64.190.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	129.159.70.95 129.159.70.95	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1 1	146.0.227.110 146.0.227.110	29066 (VELIANET-...) (VELIANET-AS velia.net Internetdienste GmbH)
1 1	88.214.206.142 88.214.206.142	46636 (NATCOWEB) (NATCOWEB)
4	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
2 4	2600:9000:210... 2600:9000:2104:5400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3 4	37.157.4.41 37.157.4.41	198622 (ADFORM) (ADFORM)
1	2a00:1450:400... 2a00:1450:4001:831::200d	15169 (GOOGLE) (GOOGLE)
2 2	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
2 4	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.33.220.241 185.33.220.241	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1 2	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
2 11	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
2 2	52.59.79.213 52.59.79.213	16509 (AMAZON-02) (AMAZON-02)
8 8	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
8 8	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5 9	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
4	2a05:d01c:1d8... 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84	16509 (AMAZON-02) (AMAZON-02)
2	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
1 1	217.182.200.20 217.182.200.20	16276 (OVH) (OVH)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
4 4	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2 5	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
3	2600:1f18:612... 2600:1f18:612b:4264:c62f:533:271f:3e7e	14618 (AMAZON-AES) (AMAZON-AES)
5 5	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
4 7	3.127.7.254 3.127.7.254	16509 (AMAZON-02) (AMAZON-02)
1	2606:2800:134... 2606:2800:134:1a0d:1429:742:782:b6	15133 (EDGECAST) (EDGECAST)
1 2	216.52.2.19 216.52.2.19	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
1	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
1	185.86.137.132 185.86.137.132	201081 (SMARTADSE...) (SMARTADSERVER)
1	18.195.155.181 18.195.155.181	16509 (AMAZON-02) (AMAZON-02)
1 1	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 3	51.89.7.198 51.89.7.198	16276 (OVH) (OVH)
1 1	52.208.41.69 52.208.41.69	16509 (AMAZON-02) (AMAZON-02)
2 2	18.195.240.234 18.195.240.234	16509 (AMAZON-02) (AMAZON-02)
1	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	75.101.244.20 75.101.244.20	14618 (AMAZON-AES) (AMAZON-AES)
1 2	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
3 3	2.19.35.65 2.19.35.65	16625 (AKAMAI-AS) (AKAMAI-AS)
6	104.109.78.125 104.109.78.125	16625 (AKAMAI-AS) (AKAMAI-AS)
14	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST)
1	2a04:4e42:3::300 2a04:4e42:3::300	54113 (FASTLY) (FASTLY)
1	141.226.224.32 141.226.224.32	200478 (TABOOLA-AS) (TABOOLA-AS)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
443	66

48 213.128.72.10 (Turkey)

ASN42926 (RADORE, TR)
PTR: server-213.128.72.10.radore.net.tr

zaytung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.186.16.22 (Turkey)

ASN197720 (TURKTICARET-AS1, TR)

app.pubserver.adhood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scontent.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:353 (United States)

ASN13335 (CLOUDFLARENET, US)

delivery.adrecover.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
15.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vidstat.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
imprammp.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wf.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c3.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 68.71.249.118 (United States)

ASN20093 (ZEROLAG, US)

udmserve.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 92.222.208.206 (Paris, France) 1 redirects

ASN16276 (OVH, FR)

trgde.adocean.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 92.222.252.172 (Paris, France) 2 redirects

ASN16276 (OVH, FR)
PTR: ip172.ip-92-222-252.eu

gdetr.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f145:82:face:b00c:0:25de (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.5.73 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany) 5 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2104:7e00:5:c4ab:c3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

bid.underdog.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States) 4 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.52 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.79 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 172.217.16.130 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.80 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.81 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 129.159.70.95 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)

sync.technoratimedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.0.227.110 (Ascension Island) 1 redirects

ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE)

inv-nets.admixer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.214.206.142 (United Kingdom) 1 redirects

ASN46636 (NATCOWEB, US)

cs.admanmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2104:5400:6:44e3:f8c0:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.4.41 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

adx.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:f916:5049:f87f:108e (United States) 2 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.234.21 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.241 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.8 (United States) 1 redirects

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 141.226.228.48 (Netherlands) 2 redirects

ASN200478 (TABOOLA-AS, IL)

am-match.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
am-vid-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-t1.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
am-wf.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.59.79.213 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-79-213.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 35.227.252.103 (Kansas City, United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.64.189.115 (United Kingdom) 8 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.144.165 (Frankfurt am Main, Germany) 5 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.182.200.20 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: gcm6.host.hit.gemius.pl

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.215.191 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 76.223.111.131 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f18:612b:4264:c62f:533:271f:3e7e (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

taboola-supply-partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.94.180.125 (Amsterdam, Netherlands) 5 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 3.127.7.254 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-7-254.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.19 (United States) 1 redirects

ASN30282 (AS-INAPCDN-OCY, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.132 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.163 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 51.89.7.198 (London, United Kingdom) 2 redirects

ASN16276 (OVH, FR)
PTR: p20.id5-sync.com

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.208.41.69 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-41-69.eu-west-1.compute.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.240.234 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-240-234.eu-central-1.compute.amazonaws.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 75.101.244.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-75-101-244-20.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.111.18 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.19.35.65 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::300 (United States)

ASN54113 (FASTLY, US)

pips.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)

cds.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
83	googlesyndication.com pagead2.googlesyndication.com 5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	1 MB
75	doubleclick.net 6 redirects pubads.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	390 KB
48	zaytung.com zaytung.com	3 MB
45	taboola.com 2 redirects cdn.taboola.com trc.taboola.com 15.taboola.com images.taboola.com vidstat.taboola.com imprammp.taboola.com am-match.taboola.com wf.taboola.com am-vid-events.taboola.com sync-t1.taboola.com c3.taboola.com sync.taboola.com match.taboola.com pips.taboola.com cds.taboola.com am-wf.taboola.com	1 MB
37	fbcdn.net static.xx.fbcdn.net scontent.xx.fbcdn.net	463 KB
24	google.com 5 redirects apis.google.com adservice.google.com www.google.com accounts.google.com	135 KB
18	rubiconproject.com 8 redirects pixel.rubiconproject.com secure-assets.rubiconproject.com eus.rubiconproject.com token.rubiconproject.com	35 KB
15	twimg.com cdn.syndication.twimg.com pbs.twimg.com	355 KB
14	pubmatic.com 13 redirects image8.pubmatic.com image2.pubmatic.com image4.pubmatic.com image6.pubmatic.com simage2.pubmatic.com	6 KB
14	facebook.com www.facebook.com	53 KB
14	googletagservices.com www.googletagservices.com	445 KB
11	quantserve.com 6 redirects secure.quantserve.com edge.quantserve.com pixel.quantserve.com cms.quantserve.com	22 KB
10	gemius.pl 3 redirects gdetr.hit.gemius.pl googlecm.hit.gemius.pl	60 KB
9	openx.net 8 redirects rtb.openx.net u.openx.net	3 KB
9	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	214 KB
7	bidswitch.net 4 redirects x.bidswitch.net	2 KB
7	2mdn.net s0.2mdn.net	231 KB
6	udmserve.net udmserve.net	7 KB
5	spotxchange.com 5 redirects sync.search.spotxchange.com	3 KB
5	adsrvr.org 2 redirects match.adsrvr.org	2 KB
5	adform.net 3 redirects s1.adform.net adx.adform.net c1.adform.net	26 KB
5	google.de adservice.google.de	653 B
4	addthis.com 4 redirects e.dlx.addthis.com	3 KB
4	innovid.com ag.innovid.com	1 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
4	quantcount.com 2 redirects rules.quantcount.com	2 KB
4	adnxs.com 3 redirects secure.adnxs.com ib.adnxs.com	4 KB
3	id5-sync.com 2 redirects id5-sync.com	4 KB
3	tremorhub.com taboola-supply-partners.tremorhub.com	547 B
3	adocean.pl 1 redirects trgde.adocean.pl	39 KB
2	3lift.com 1 redirects eb2.3lift.com	736 B
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com	1 KB
2	lijit.com 1 redirects ce.lijit.com	1018 B
2	rlcdn.com 2 redirects id.rlcdn.com	883 B
2	mookie1.com odr.mookie1.com	430 B
2	agkn.com 2 redirects d.agkn.com	1 KB
2	underdog.media bid.underdog.media	147 KB
2	google-analytics.com 1 redirects www.google-analytics.com	17 KB
2	adrecover.com delivery.adrecover.com	13 KB
2	facebook.net connect.facebook.net	69 KB
2	adhood.com app.pubserver.adhood.com	958 B
1	postrelease.com jadserve.postrelease.com	428 B
1	gumgum.com 1 redirects rtb.gumgum.com	305 B
1	criteo.com 1 redirects dis.criteo.com	546 B
1	emxdgt.com e1.emxdgt.com	59 B
1	smartadserver.com rtb-csync.smartadserver.com	697 B
1	contextweb.com bh.contextweb.com	406 B
1	gstatic.com ssl.gstatic.com	4 KB
1	admanmedia.com 1 redirects cs.admanmedia.com	394 B
1	admixer.net 1 redirects inv-nets.admixer.net	472 B
1	technoratimedia.com sync.technoratimedia.com	291 B
1	googleadservices.com partner.googleadservices.com	257 B
1	onesignal.com cdn.onesignal.com	3 KB
443	53

	Domain	Requested by
52	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com zaytung.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
48	zaytung.com	zaytung.com
36	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net zaytung.com
33	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
29	pagead2.googlesyndication.com	zaytung.com pagead2.googlesyndication.com googleads.g.doubleclick.net ad.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
26	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
14	pbs.twimg.com	zaytung.com
14	www.facebook.com	zaytung.com connect.facebook.net www.facebook.com static.xx.fbcdn.net
14	www.googletagservices.com	zaytung.com pagead2.googlesyndication.com www.googletagservices.com googleads.g.doubleclick.net securepubads.g.doubleclick.net s0.2mdn.net
12	www.google.com	5 redirects googleads.g.doubleclick.net securepubads.g.doubleclick.net apis.google.com tpc.googlesyndication.com
9	vidstat.taboola.com	cdn.taboola.com vidstat.taboola.com
9	gdetr.hit.gemius.pl	2 redirects trgde.adocean.pl gdetr.hit.gemius.pl zaytung.com
8	image6.pubmatic.com	8 redirects
8	rtb.openx.net	8 redirects
8	cdn.taboola.com	zaytung.com cdn.taboola.com
7	x.bidswitch.net	4 redirects imprammp.taboola.com am-match.taboola.com
7	s0.2mdn.net	tpc.googlesyndication.com zaytung.com s0.2mdn.net googleads.g.doubleclick.net
7	platform.twitter.com	zaytung.com platform.twitter.com
6	eus.rubiconproject.com	imprammp.taboola.com am-match.taboola.com eus.rubiconproject.com
6	pixel.rubiconproject.com	5 redirects zaytung.com
6	udmserve.net	pubads.g.doubleclick.net zaytung.com bid.underdog.media
6	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net zaytung.com
6	apis.google.com	zaytung.com apis.google.com accounts.google.com
5	sync-t1.taboola.com	imprammp.taboola.com am-match.taboola.com zaytung.com
5	sync.search.spotxchange.com	5 redirects
5	match.adsrvr.org	2 redirects imprammp.taboola.com am-match.taboola.com
5	cms.quantserve.com	4 redirects googleads.g.doubleclick.net
5	adservice.google.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
5	adservice.google.de	securepubads.g.doubleclick.net pagead2.googlesyndication.com
4	e.dlx.addthis.com	4 redirects
4	ag.innovid.com	googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	scontent.xx.fbcdn.net	www.facebook.com
4	pixel.quantserve.com	2 redirects zaytung.com
4	trc.taboola.com	cdn.taboola.com zaytung.com
4	rules.quantcount.com	2 redirects zaytung.com
4	googleads4.g.doubleclick.net	zaytung.com googleads.g.doubleclick.net
3	token.rubiconproject.com	eus.rubiconproject.com
3	secure-assets.rubiconproject.com	3 redirects
3	id5-sync.com	2 redirects
3	taboola-supply-partners.tremorhub.com	imprammp.taboola.com am-match.taboola.com
3	images.taboola.com	zaytung.com
3	image8.pubmatic.com	3 redirects
3	trgde.adocean.pl	1 redirects zaytung.com trgde.adocean.pl
2	eb2.3lift.com	1 redirects
2	rtb.mfadsrvr.com	2 redirects
2	c1.adform.net	2 redirects
2	ce.lijit.com	1 redirects zaytung.com
2	sync.taboola.com	2 redirects
2	id.rlcdn.com	2 redirects
2	odr.mookie1.com	googleads.g.doubleclick.net
2	d.agkn.com	2 redirects
2	wf.taboola.com	vidstat.taboola.com
2	am-match.taboola.com	vidstat.taboola.com
2	imprammp.taboola.com	zaytung.com vidstat.taboola.com
2	syndication.twitter.com	1 redirects platform.twitter.com
2	ib.adnxs.com	1 redirects googleads.g.doubleclick.net
2	adx.adform.net	1 redirects zaytung.com
2	15.taboola.com	cdn.taboola.com
2	secure.adnxs.com	2 redirects
2	bid.underdog.media	udmserve.net bid.underdog.media
2	www.google-analytics.com	1 redirects zaytung.com
2	delivery.adrecover.com	zaytung.com
2	connect.facebook.net	zaytung.com connect.facebook.net
2	app.pubserver.adhood.com	zaytung.com
1	ade.googlesyndication.com
1	am-wf.taboola.com	vidstat.taboola.com
1	cds.taboola.com	cdn.taboola.com
1	pips.taboola.com	cdn.taboola.com
1	jadserve.postrelease.com	zaytung.com
1	u.openx.net	zaytung.com
1	match.taboola.com
1	rtb.gumgum.com	1 redirects
1	dis.criteo.com	1 redirects
1	e1.emxdgt.com	zaytung.com
1	rtb-csync.smartadserver.com	zaytung.com
1	bh.contextweb.com	zaytung.com
1	simage2.pubmatic.com	zaytung.com
1	cdn.syndication.twimg.com	platform.twitter.com
1	c3.taboola.com	zaytung.com
1	googlecm.hit.gemius.pl	1 redirects
1	am-vid-events.taboola.com	zaytung.com
1	ssl.gstatic.com	accounts.google.com
1	accounts.google.com	apis.google.com
1	cs.admanmedia.com	1 redirects
1	inv-nets.admixer.net	1 redirects
1	sync.technoratimedia.com	zaytung.com
1	image4.pubmatic.com	1 redirects
1	image2.pubmatic.com	1 redirects
1	edge.quantserve.com	udmserve.net
1	secure.quantserve.com	udmserve.net
1	s1.adform.net	securepubads.g.doubleclick.net
1	ad.doubleclick.net	www.googletagservices.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	zaytung.com
1	5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	pubads.g.doubleclick.net	zaytung.com
1	cdn.onesignal.com	zaytung.com
443	98

This site contains links to these domains. Also see Links.

Domain
store.zaytung.com
gdetr.hit.gemius.pl
radore.com
www.zaytungzone.com
www.facebook.com
twitter.com
kurul.diyanet.gov.tr
popup.taboola.com
iaevm.com
kjocy.com
partners.etoro.com
www.rh.com.tr

Subject Issuer	Validity	Valid
*.apis.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-04` - `2022-07-03`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
udmserve.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-08-21`	a year	crt.sh
*.adocean.pl Sectigo ECC Domain Validation Secure Server CA	`2020-01-27` - `2022-02-05`	2 years	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.hit.gemius.pl Sectigo ECC Domain Validation Secure Server CA	`2019-09-11` - `2021-09-24`	2 years	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.technoratimedia.com DigiCert SHA2 High Assurance Server CA	`2020-07-28` - `2021-10-01`	a year	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
accounts.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.tremorhub.com Amazon	`2021-06-27` - `2022-07-26`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2021-03-11` - `2022-04-12`	a year	crt.sh
*.contextweb.com DigiCert SHA2 Secure Server CA	`2020-05-07` - `2022-05-12`	2 years	crt.sh
*.smartadserver.com DigiCert ECC Secure Server CA	`2020-01-30` - `2022-02-03`	2 years	crt.sh
*.emxdgt.com Go Daddy Secure Certificate Authority - G2	`2021-05-18` - `2022-06-19`	a year	crt.sh
*.id5-sync.com R3	`2021-07-13` - `2021-10-11`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.postrelease.com Amazon	`2021-01-28` - `2022-02-25`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh

This page contains 56 frames:

Primary Page: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Frame ID: FC7AC593F94827BA16DD69ABB04EBF20
Requests: 150 HTTP requests in this frame

Frame: https://5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6B13C63DCEAB33E9605AF019C931FAE0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210812/r20190131/zrt_lookup.html
Frame ID: 9260D3F7E02EFA66ACDA7B35C3EBF0CC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&adk=1812271804&adf=3025194257&lmt=1629223066&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&ea=0&flash=0&pra=5&wgl=1&dt=1629223066523&bpp=3&bdt=579&idt=108&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1884844164231&frm=20&pv=2&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=11&uci=a!b&fsb=1&dtd=121
Frame ID: B78079D1DD632BF0F8A6827B5C3E7D05
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137
Frame ID: 060AA61B3641CF9A60F927EC37DE1074
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126
Frame ID: EA98C5C801412448E19BBAC85B2AD2E8
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5
Frame ID: 1CAA1C236D646E9BF2C4CA81D6BE9178
Requests: 12 HTTP requests in this frame

Frame: https://gdetr.hit.gemius.pl/gdejs/xgde.html
Frame ID: 104D2A6689E8DC6D5EEFF5B3C97BA02C
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html
Frame ID: 8D4B4B16662A8E528AAFF9B4458B3A74
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 60489F064D6EB785373F983834983360
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
Frame ID: 7F0B96E6B578A35E7B3D94DF4D201F40
Requests: 10 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvq6WDD4Ol54y2xqb2wje-S9ZngTV5gxChKOjPtNh9hyxaExaSoXbGrBMn9QbrqhUy6DyMkYM0DhMQdP2Anig3JQVyg9TpcbYymmEhpxBNCe-SmK_aMGpW1ZCi4iukNF7szTDrCJ1ZGmJJFUxGksoif6xPlk01RHMEwNCYfrLpjAea2FcwtuqPg5OVSTplXneCtdAG9QVgVrnd_yQDBvv_soCoBR19zWQR0a06GpZFCX9NQ3haQA_KlXdSXITXTT6fCxA9PmMzTjQFN9yutBh0YYAJh8hVbDsjws7EB3iP7K6SxSaA&sig=Cg0ArKJSzF1XtclkXIWKEAE&adurl=
Frame ID: 335B34C60D08D1A493834495A80D35DF
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
Frame ID: 667AEC761E14B127828497ACCAF42823
Requests: 9 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&
Frame ID: 0F39AA379BF68898EF1F316B243CB16D
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss36AkAZt7tpnIrKYZI8wzfTEfewK0pi-_t3NECVtGvDHhYH8si1O8EoDEJkIThWvdEi8TxUhtd5DUwn14Q8JnvFA6VfnQeSL9lCFuF8Z-PuYi07I-sTU29MMMLDS5RVG1F_lbSHaCkqY6BfmigsGFEzKXylnr3e2H9RUwMFXrp6KEXqthrwuOWGusE2V7GLab8va_VH6jdFzHhLLSscxLEqHGx0e_h16lQFRKXONjmzaYCnrsjJ4LRqiLqmwLcmStYREzbmLFcCZqgiZfYb8yAet292JhZB0bmsSorcmjP9QiBJg&sig=Cg0ArKJSzLp65K7qVJjYEAE&urlfix=1&adurl=
Frame ID: A0F56600221F7D830168F2F69848DEC9
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
Frame ID: 30EE024856560FFC79E75E68208237F6
Requests: 10 HTTP requests in this frame

Frame: http://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C97982079B6F63B25693DE6E3A4CC515
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/10978836/1625049614695/320x100.html
Frame ID: 68F12C67A5B7720E323D8190074A1E65
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19
Frame ID: F791B6004F097B8F12E3F48DF29E6C2B
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html
Frame ID: B77B38C7F16911E0DDB64A542BAF6E16
Requests: 10 HTTP requests in this frame

Frame: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
Frame ID: 000904D2206219A03E307267F0E3E679
Requests: 22 HTTP requests in this frame

Frame: https://www.facebook.com/v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df13c15e3bac836%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=604&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false
Frame ID: 1AC69C2EDCC55C64D46E8E10674200AD
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfc389fd46ab38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=93&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500
Frame ID: 85F3FA9DE65BEAD19FD5827DE8803A49
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=http%3A%2F%2Fzaytung.com
Frame ID: B4E5558B6AFA4F485E6713BBB4162954
Requests: 2 HTTP requests in this frame

Frame: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&origin=http%3A%2F%2Fzaytung.com&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__
Frame ID: 936F626EDCE3327FD18AC49FE2F43944
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 6EA62D5DD1563B6AC654AE30011CFDB0
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ
Frame ID: 4696AA3694CA9CE75D2A02AC6B67D8B7
Requests: 5 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fzaytung.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__
Frame ID: BE7EA8AA24E422FE8F62B0D0F056C14D
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D556CE19279AD83A81E7A9D49D1EBB43
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 2D12B0E03107E60A3CE4F7D96BFD7A0F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B2BC94319618A5504ECEDD6C9A7E0B15
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 49C7D4F5070EF94D51FA61DE20BACDF5
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 17E1E2F8A9B5D1CF704392A586A935A5
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C7686C2DF42965FDC889DAC7B6726C1D
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 0EA781CCB9DC9F7E5AEC973BDBB2D4C1
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4C5D4EB9B8E3AC8D1DE62AE515EE849C
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D16B995C0158192392C04675DF773686
Requests: 9 HTTP requests in this frame

Frame: http://imprammp.taboola.com/st?cipid=7991117&ttype=0&cirid=BFFF74B5BD622161551465014654&cicmp=1337627&cijs=1&dast=V79v4CFgMx4ZFo0aUEZgQx4ZFo0aUEZgUAAAAGBugHG0Kj0XijCWtCok0mi9liNRqNdoPlZrmcLCFhFovFaDJbDadgsIXP6e5uwwSaTofrXi99OE-vu8-u8bv9cgAAAAB4ACBqiYbY8W1ojwAAAACQ4Bm5VqAIqPi3ELgAAAAAwAAgEAvXAEjiIHCnx-UPAICHAhAAAAGMEAC_cWERAAAAgBEAAAAAEgCBxMISAIe7RRMAgIC9qiGRjRMAAICDOpmnbZb_____GIC89yYZAIq0jRuDHoAHH4AHIQAAgIshlNIzW-TKWAiiAsUiRgAAAABSZhJyR5I6obKo-v___7cCuAIACNirGhKRybo5KWYNAwAAABhboIfF7zc77Bq_22X__________2b_ZwBoQi7MzWlA6AAAajwj1wprv4AAAGzvBgDwJgAXcwB2AAAAAHf_____eQAAABN7lGyv1Xj2KOt9Blv4nO7u-k3YYrSaTDbL4Wy5mAyGo-FotD8BXA5wIgbL5WSymOxWo9VoM9yNZoMFCsRgghQtGkxWo9FkMRmuRpPVbLnY7TZI0arVbLQZDFezyWy3Ww0Hw-VohBO2GK0mk81yOFsuJoPhaDgaDfGg6lw6n1en4sF8XM597cHHBpzMFYPJXDGcKxajVQIAAAAAAAAAWMKUeRMAAACA0yBms8lut-LGmz0TxFqtljUAAAAAt27kAA!&excid=22&tst=1&docw=0&cs=false
Frame ID: 85C1FC408093A402B9681BEBFE456A69
Requests: 1 HTTP requests in this frame

Frame: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Frame ID: DF135B3464A1DAED001ADD315A808CC6
Requests: 5 HTTP requests in this frame

Frame: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Frame ID: A4B40A5C6432119269EB906A8B93B7F3
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js
Frame ID: B2EF43244B980C2390451159E3E8FB6F
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js
Frame ID: D881BA39AB8D654BEDB820D69F21719D
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fv2.2%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D1554908878104117%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df17fd14cd9f6f38%2526domain%253Dzaytung.com%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fzaytung.com%25252Ff199a47a4129d24%2526relation%253Dparent.parent%26container_width%3D0%26height%3D600%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzaytungstore%252F%26locale%3Dtr_TR%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dtrue%26tabs%3Dtimeline%26width%3D300
Frame ID: 690785636B05135DBBB9D03F60EB07F1
Requests: 23 HTTP requests in this frame

Frame: https://www.facebook.com/v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df26f7f61f1996a%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false
Frame ID: B83EBEC2EFD230D26697C89857C6F90B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df18082e52b4fafc%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=0&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500
Frame ID: 9D28E8578F4DF8E01C39DDFBEF1704B2
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js
Frame ID: 6F4CC709F77937C62B433BC34F1619FB
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js
Frame ID: 81AFC3E533A4B605BBC061D007743FBA
Requests: 1 HTTP requests in this frame

Frame: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Frame ID: 4BD81695C7F5664BE4037EB222688D18
Requests: 5 HTTP requests in this frame

Frame: https://pixel.rubiconproject.com/exchange/sync.php?p=16698
Frame ID: 8B2A26C6248C917A1BAF979CEC0B1F63
Requests: 16 HTTP requests in this frame

Frame: https://platform.twitter.com/css/timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
Frame ID: C25D7BFA96966EA6380017ABEA990399
Requests: 20 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Frame ID: 8B1A9D00927FEDFDF76F109992961768
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Frame ID: BC4D874A3F5276947457F8C92F44407C
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Frame ID: 4891C87126805DAF6BAE6C59E7E965F6
Requests: 3 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 4692305A8425CFDD12193F9F2AC70E5C
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 48BC38F8F1F24C819E7BD4ABA5029817
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E94777A26D907B3B78485FD6F1F275BB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
url /\.aspx?(?:$|\?)/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

url /\.aspx?(?:$|\?)/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
url /\.aspx?(?:$|\?)/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /apis\.google\.com\/js\/[a-z]*\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

443
Requests

79 %
HTTPS

40 %
IPv6

53
Domains

98
Subdomains

66
IPs

10
Countries

8003 kB
Transfer

16156 kB
Size

4
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: http://store.zaytung.com/
Title: Store

Search URL Search Domain Scan URL

URL: https://gdetr.hit.gemius.pl/hitredir/id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=jexzjyafpwfkkdamwdmqokzpcply/stparam=ykopfudiog/roc=0/url=https://www.paribu.com/?utm_source=Zaytung&utm_medium=Standard_banner&utm_campaign=Fenerbahce_Token#/fenerbahce-token

Search URL Search Domain Scan URL

URL: https://radore.com/?utm_source=zaytung&utm_medium=sondakika

Search URL Search Domain Scan URL

URL: http://www.zaytungzone.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dialog/feed?app_id=1554908878104117&link=http://www.zaytung.com/fotohaberdetay.asp?newsid=395636&picture=http://www.zaytung.com/fotos/D6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A.jpeg&name=Zaytung%20FotoHaber%20-%20A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi:%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%20adab%C4%B1n%C4%B1%20da%20tespit%20etmek%20suretiyle%E2%80%A6%E2%80%9D%20&caption=www.zaytung.com&description=&redirect_uri=http://www.facebook.com
Title: facebook'ta paylaş

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=http://zaytung.com/fotohaberdetay.asp?newsid=395636&text=Zaytung%20FotoHaber%20-%20A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi:%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%20adab%C4%B1n%C4%B1%20da%20tespit%20etmek%20suretiyle%E2%80%A6%E2%80%9D&related=zaytung&lang=tr
Title: twitter'a yolla

Search URL Search Domain Scan URL

URL: https://kurul.diyanet.gov.tr/
Title: Allah'a havale et

Search URL Search Domain Scan URL

URL: https://popup.taboola.com/tr/?template=colorbox&utm_source=zaytung&utm_medium=referral&utm_content=thumbnails-il:Inline%20Thumbnails:
Title:

Search URL Search Domain Scan URL

URL: http://iaevm.com/cid/f4a30ad5-1eb8-44a1-b4c4-b0a291e04443?campaignid=11085931&platform=Desktop&campaignitemid=3009867057&site=zaytung&clickid=GiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyDlok0oxfPsi629j9Qm&timestamp=2021-08-17+17%3A57%3A47&thumbnail=http%3A%2F%2Fiaevm.com%2Fcontent%2F2ea6a324-6abd-468a-8b88-200dee9615b3.jpg&title=Implants+dentaires%3A+Ce+dentiste+de+Nice+est+le+meilleur#tblciGiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyDlok0oxfPsi629j9Qm
Title: Prix implant dentaire | Liens de recherche

Search URL Search Domain Scan URL

URL: http://kjocy.com/cid/05ba1b46-58b8-41e6-8c5b-eef3b13f0569?campaignid=11391541&platform=Desktop&campaignitemid=3013004887&site=zaytung&clickid=GiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyCKyVQolY_5y6ynxYv3AQ&timestamp=2021-08-17+17%3A57%3A47&thumbnail=http%3A%2F%2Fkjocy.com%2Fcontent%2Fe87deb77-2add-4f7c-8a5c-717125dd97f5.jpeg&title=Provence-alpes-cote-d%27azur+-+ces+voitures+hybrides+ne+co%C3%BBtent+presque+rien#tblciGiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyCKyVQolY_5y6ynxYv3AQ
Title: Véhicule hybride pas cher | Liens de recherche

Search URL Search Domain Scan URL

URL: https://partners.etoro.com/aw.aspx?A=45729&Task=Click&SubAffiliateID=FR_HF_Desk_Direct_Stocks_20M_21-03-21_Taboola_AFFID_45729&TargetURL=https://go.etoro.com/fr/20M-users&utm_source=taboola&utm_medium=referral&tblci=GiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyCY_EgosdWe4ZfmnIrEAQ#tblciGiDQDYGi3JlocyorNGtCPl03nAj_VaPF9qyainwHXFfxJyCY_EgosdWe4ZfmnIrEAQ
Title: eToroAdvertisement

Search URL Search Domain Scan URL

URL: http://www.rh.com.tr/
Title: radore

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

http://connect.facebook.net/tr_TR/sdk.js HTTP 307
https://connect.facebook.net/tr_TR/sdk.js

Request Chain 52

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 56

https://trgde.adocean.pl/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir= HTTP 301
https://trgde.adocean.pl/__/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=

Request Chain 60

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=203177410&utmhn=zaytung.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Zaytung%20FotoHaber%20-%20A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%20adab%C4%B1n%C4%B1%20da%20tespit%20etmek%20suretiyle%E2%80%A6%E2%80%9D&utmhid=106732675&utmr=-&utmp=%2Ffotohaberdetay.asp%3Fnewsid%3D395636&utmht=1629223066607&utmac=UA-11942895-1&utmcc=__utma%3D247317775.648631566.1629223066.1629223066.1629223066.1%3B%2B__utmz%3D247317775.1629223067.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1374516380&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAQAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=203177410&utmhn=zaytung.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Zaytung%20FotoHaber%20-%20A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%20adab%C4%B1n%C4%B1%20da%20tespit%20etmek%20suretiyle%E2%80%A6%E2%80%9D&utmhid=106732675&utmr=-&utmp=%2Ffotohaberdetay.asp%3Fnewsid%3D395636&utmht=1629223066607&utmac=UA-11942895-1&utmcc=__utma%3D247317775.648631566.1629223066.1629223066.1629223066.1%3B%2B__utmz%3D247317775.1629223067.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1374516380&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAQAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-11942895-1&cid=648631566.1629223066&jid=1374516380&_v=5.7.2&z=203177410

Request Chain 116

http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false& HTTP 307
https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&

Request Chain 127

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 131

https://secure.adnxs.com/getuid?https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bapnid%3D%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fdt%253D1%253Bapnid%253D%2524UID HTTP 302
https://udmserve.net/udm/fetch.pix?dt=1;apnid=6877626773716791149

Request Chain 132

https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fpmid%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fpmid%253D%2523PMUID&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjVFNjgzQjgtQTc0Ni00NUI0LUFBRDQtMzBGMEU1NTc5MjlF&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156505&pmc=1&pr=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fpmid%3DB5E683B8-A746-45B4-AAD4-30F0E557929E HTTP 302
https://udmserve.net/udm/fetch.pix?pmid=B5E683B8-A746-45B4-AAD4-30F0E557929E

Request Chain 134

https://inv-nets.admixer.net/adxcm.aspx?ssp=F74A1705-8854-4390-959E-C24FA4349F88&rurl=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Badmix%3D%24%24visitor_cookie%24%24 HTTP 302
https://udmserve.net/udm/fetch.pix?dt=1;admix=bcf905babaae460a9cf134b3ac10ddee

Request Chain 135

https://cs.admanmedia.com/sync/underdog?redir=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bacu%3D%7B%24UID%7D HTTP 302
https://udmserve.net/udm/fetch.pix?dt=1;acu=58c80c8e8be87fc5c8bba67a994ab49d9205f32e

Request Chain 155

http://rules.quantcount.com/rules-p-effSsmMYCbAck.js HTTP 301
https://rules.quantcount.com/rules-p-effSsmMYCbAck.js

Request Chain 156

http://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js HTTP 301
https://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js

Request Chain 176

https://gdetr.hit.gemius.pl/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636 HTTP 301
https://gdetr.hit.gemius.pl/__/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636

Request Chain 179

https://adx.adform.net/adx/?rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286 HTTP 302
https://adx.adform.net/adx/?CC=1&rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286

Request Chain 215

http://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068317;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website HTTP 301
https://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068317;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website

Request Chain 216

http://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068326;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website HTTP 301
https://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068326;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website

Request Chain 261

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH0vJxeA5NvXywBiAq6hMzk&google_cver=1

Request Chain 262

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRv4nDFU0-nVI66PK4U-RAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG1aK3iTsxXMqWxa8Ctbg7U&google_cver=1

Request Chain 263

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESELP6PMcMVpiMFYAnOc3_Rb4&google_cver=1

Request Chain 264

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D&google_tc=

Request Chain 273

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 290

https://gdetr.hit.gemius.pl/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636 HTTP 301
https://gdetr.hit.gemius.pl/__/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636

Request Chain 303

https://d.agkn.com/pixel/2175/?google_gid=CAESEHssZ3c7hc1-PIoDriXXrHw&google_cver=1&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3

Request Chain 304

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&google_hm=xGro3b1uzMEzccykrMj-TQ==

Request Chain 305

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPK58Mc6C7-La4pjQG3lszqBpYFqaaQawVeNq2mbgeZA1FbRvq_yGUggDQu7gyjcvLaQpJ0oGzc9_iEFtQJBNF6w2gqeA0c4 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPK58Mc6C7-La4pjQG3lszqBpYFqaaQawVeNq2mbgeZA1FbRvq_yGUggDQu7gyjcvLaQpJ0oGzc9_iEFtQJBNF6w2gqeA0c4&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uamFeVZUT7-esUQWlnk47g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK58Mc6C7-La4pjQG3lszqBpYFqaaQawVeNq2mbgeZA1FbRvq_yGUggDQu7gyjcvLaQpJ0oGzc9_iEFtQJBNF6w2gqeA0c4

Request Chain 306

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiUHe_3Q2GgEEYWiZYS_exTj_Ntr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMVkwtMjItR1M1Sw==&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiUHe_3Q2GgEEYWiZYS_exTj_Ntr

Request Chain 307

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA

Request Chain 311

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xCW2iS08vacZ54RDlghdPhM9JxdK54wwKeqljX_z0nmm HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xCW2iS08vacZ54RDlghdPhM9JxdK54wwKeqljX_z0nmm&google_hm=IGyJIrI7BZf9VaIshEcg-g

Request Chain 312

https://d.agkn.com/pixel/2175/?google_gid=CAESEHssZ3c7hc1-PIoDriXXrHw&google_cver=1&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3

Request Chain 314

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj4nbuwD3VWwvZxo7-uHn0YyR4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV0EtUC1HUTVJ&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj4nbuwD3VWwvZxo7-uHn0YyR4

Request Chain 315

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc

Request Chain 317

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEFamw8p7p459VYwvdxcF_zo&google_cver=1&google_push=AYg5qPJY_vSF9tuEb26O-kvEHmu875tjoxqcsghQi5KBN784cMFFSqDwpFi2KUct85bEZ6czTC3Yu0t14gwVi-ub_TgPGsPPGpljPg HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJY_vSF9tuEb26O-kvEHmu875tjoxqcsghQi5KBN784cMFFSqDwpFi2KUct85bEZ6czTC3Yu0t14gwVi-ub_TgPGsPPGpljPg&google_hm=nmmzplrfgykclefwzasuzrxpcynz

Request Chain 319

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWVBOzn7gRFZd1i-PsIzqhIi-AnVK2IGhPugO6lPH5hw HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWVBOzn7gRFZd1i-PsIzqhIi-AnVK2IGhPugO6lPH5hw&google_hm=IGyJIrI7BZf9VaIshEcg-g

Request Chain 320

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIX1ABagPcVc-XZnl0Axjy9gdjZY035EJLJznbVPaGTWwbcr25M_KvKt1W2XGLHG26t0RGMWx_KiToiwoGO2mtql8We8A&google_gid=CAESEKNlvaIeAUJOSK8oys_A7gA&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCKDx74gGEgUI6AcQAEIASm5nb29nbGVfcHVzaD1BWWc1cVBJWDFBQmFnUGNWYy1YWm5sMEF4ank5Z2RqWlkwMzVFSkxKem5iVlBhR1RXd2JjcjI1TV9Ldkt0MVcyWEdMSEcyNnQwUkdNV3hfS2lUb2l3b0dPMm10cWw4V2U4QQ HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwNkVyYzF5UjEzeEFQQlB3VkN3R0EyMno5SVBSaUs4SG5hVV84Z0lwSnozMA==&google_push

Request Chain 321

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&google_hm=xGro3b1uzMEzccykrMj-TQ==

Request Chain 322

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPKG9etAcfjf2hyZjDd3U4gZ_0C9AehJBZPSbxAouTMePjd75x4Z-_3gmcXzURZEzq2cpyfwzynmJqcRednnQiQXrC8B2Vo HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPKG9etAcfjf2hyZjDd3U4gZ_0C9AehJBZPSbxAouTMePjd75x4Z-_3gmcXzURZEzq2cpyfwzynmJqcRednnQiQXrC8B2Vo&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rhOlxunTLiFl1EcoJeE3A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKG9etAcfjf2hyZjDd3U4gZ_0C9AehJBZPSbxAouTMePjd75x4Z-_3gmcXzURZEzq2cpyfwzynmJqcRednnQiQXrC8B2Vo

Request Chain 323

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVwoNfDOc37sX-517lK_Pgzwog HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1ItMTktOENYVw==&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVwoNfDOc37sX-517lK_Pgzwog

Request Chain 324

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1

Request Chain 327

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 328

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrwdwZ48eEHXp6K5-kEA2gEMmi6_rzY95_RlBbAMoU2I HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrwdwZ48eEHXp6K5-kEA2gEMmi6_rzY95_RlBbAMoU2I&google_hm=IGyJIrI7BZf9VaIshEcg-g

Request Chain 329

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk_9CZ-3jZ5vktSIlST9bCJtc3caJzA&google_gid=CAESEOCNPMg0efP4FjOwvTLczp4&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk_9CZ-3jZ5vktSIlST9bCJtc3caJzA&google_gid=CAESEOCNPMg0efP4FjOwvTLczp4&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NDkwMDAxMzkyNDU0NjI3Mw%3D%3D&google_push=AYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk_9CZ-3jZ5vktSIlST9bCJtc3caJzA

Request Chain 331

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&google_hm=xGro3b1uzMEzccykrMj-TQ==

Request Chain 332

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPIHlyowoqXleJVKqDqmylBRjHk4jcFDZlaEEFCqtdL96cH6wvPz6OyJn4xW7M32C3RSpchSnvIN8WZBXH_71GJBQ8ieZsJ9 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPIHlyowoqXleJVKqDqmylBRjHk4jcFDZlaEEFCqtdL96cH6wvPz6OyJn4xW7M32C3RSpchSnvIN8WZBXH_71GJBQ8ieZsJ9&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ugpML9J-SjOxApDlcXTOxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHlyowoqXleJVKqDqmylBRjHk4jcFDZlaEEFCqtdL96cH6wvPz6OyJn4xW7M32C3RSpchSnvIN8WZBXH_71GJBQ8ieZsJ9

Request Chain 333

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9ZAyiLCQpwG6YagbtFUcU_Fi84N HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1MtUC1ISTZL&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9ZAyiLCQpwG6YagbtFUcU_Fi84N

Request Chain 334

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc

Request Chain 336

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 338

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2slJU2KrKFZ7Psi4hkvAZyESxEZsnAoJc1zk2P5bGdBxlQ HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2slJU2KrKFZ7Psi4hkvAZyESxEZsnAoJc1zk2P5bGdBxlQ&google_hm=IGyJIrI7BZf9VaIshEcg-g

Request Chain 339

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6E9pVBCYNknvWEFzMpxGL1IsPeuEXfZ&google_gid=CAESEOCNPMg0efP4FjOwvTLczp4&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6E9pVBCYNknvWEFzMpxGL1IsPeuEXfZ&google_gid=CAESEOCNPMg0efP4FjOwvTLczp4&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NTAwMDAxNjE3NzU5Njg5Mw%3D%3D&google_push=AYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6E9pVBCYNknvWEFzMpxGL1IsPeuEXfZ

Request Chain 340

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg&google_hm=xGro3b1uzMEzccykrMj-TQ==

Request Chain 341

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPLWh_IF3JmNJXoeUTkVgahSl8hyD-yIQwJUATQQ9bdkB4MJjbORHFSYF17LiS-sRBYa1rHXSk44MtKkR_8kC_BZ_Z80YS557Q HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJXYACKBQ3TDDsnls7aHgXA&google_cver=1&google_push=AYg5qPLWh_IF3JmNJXoeUTkVgahSl8hyD-yIQwJUATQQ9bdkB4MJjbORHFSYF17LiS-sRBYa1rHXSk44MtKkR_8kC_BZ_Z80YS557Q&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OmzDjhxoT-WSUb8iVdLnsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWh_IF3JmNJXoeUTkVgahSl8hyD-yIQwJUATQQ9bdkB4MJjbORHFSYF17LiS-sRBYa1rHXSk44MtKkR_8kC_BZ_Z80YS557Q

Request Chain 342

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjShZUkuou-m62QlWcRXLiZu4iAkPtA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMWVMtMUYtREdURw==&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjShZUkuou-m62QlWcRXLiZu4iAkPtA

Request Chain 343

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U

Request Chain 350

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3Dvideo%26us_privacy%3D1---gdpr%3D1%26 HTTP 302
https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3Dvideo%26us_privacy%3D1---gdpr%3D1%26&__user_check__=1&sync_id=a2c0f9e3-ff84-11eb-97a1-1ac857eb0206 HTTP 302
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

Request Chain 356

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 361

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3Dvideo%26us_privacy%3D1---gdpr%3D1%26 HTTP 302
https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3Dvideo%26us_privacy%3D1---gdpr%3D1%26&__user_check__=1&sync_id=a2d235a9-ff84-11eb-898c-124172220306 HTTP 302
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

Request Chain 386

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEB2ambZMb5A26XnNuS2njyk&google_cver=1

Request Chain 388

https://sync.taboola.com/sg/google-network/1/rtb?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e

Request Chain 389

https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=b65c7689-8ac6-4af8-a6db-ad11e3b91be1

Request Chain 390

https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent=&dnr=1

Request Chain 394

https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40 HTTP 302
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=77701eb7-2dfa-42ac-b72c-fe23ee93e4bb

Request Chain 395

https://id5-sync.com/s/464/9.gif?puid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%7BID5UID%7D HTTP 302
https://id5-sync.com/c/464/464/7/1.gif?puid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=1&gdpr_consent= HTTP 302
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F6%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D1%26gdpr_consent%3D&gdpr=1&gdpr_consent= HTTP 302
https://id5-sync.com/c/464/441/6/2.gif?puid=e_d19142b4-d46e-463c-b5cd-9fdd5374776a&gdpr=1&gdpr_consent=

Request Chain 396

https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=taboola&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=taboola HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=taboola HTTP 302
https://x.bidswitch.net/sync?dsp_id=70&user_id=3554357157478683836&ssp=taboola HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=3554357157478683836&ssp=taboola HTTP 302
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=0a1721d8-e912-4c1e-8f1f-8e3ebc7c2042

Request Chain 397

https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b HTTP 302
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b&tbid=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e&query=taboola_hm%3Df6121a1b-437c-4df8-82b7-4350a0b4082b&isDirect=0

Request Chain 400

https://eb2.3lift.com/xuid?mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla&gdpr=1&cmp_cs=&us_privacy=

Request Chain 404

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint= HTTP 301
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

Request Chain 407

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3Dvideo%26us_privacy%3D1---gdpr%3D1%26 HTTP 302
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

Request Chain 409

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint= HTTP 301
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

Request Chain 439

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint= HTTP 301
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

Request Chain 448

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

443 HTTP transactions
17 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set fotohaberdetay.asp Show response
zaytung.com/ 84 KB
25 KB 982ms
943ms Document
text/html 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 2424c418cd00e6b522d0bf97e38bfbfb2d743a34d46bb1f6ca8ec433227a2bda

Request headers

Host: zaytung.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Cache-Control: private
Content-Type: text/html; Charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; path=/
X-Powered-By: ASP.NET
Date: Tue, 17 Aug 2021 17:57:45 GMT
Content-Length: 25721

GET
H2 200 plusone.js Show response
apis.google.com/js/ 54 KB
21 KB 115ms
113ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f6390c8d956a7f64e65782ade728dd1c30881b91d6c155e8b00930277fd74bef

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZHBNfhZnyoWkws8wZuqxJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "d686fddac5457bf0de3b958d49856ad1"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-ZHBNfhZnyoWkws8wZuqxJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK jquery-1.11.0.min.js Show response
zaytung.com/js/ 94 KB
33 KB 134ms
114ms Script
application/x-javascript 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/js/jquery-1.11.0.min.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 24 Mar 2014 09:39:11 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "8098e94447cf1:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 33470

GET
H/1.1 200
OK site1.css
zaytung.com/ 9 KB
3 KB 135ms
115ms Stylesheet
text/css 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/site1.css
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ee2a6113bbd579c4eab50e3fa4a4757b28db357b67c81abc416007fc59d63bf9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Tue, 30 Jun 2015 15:33:27 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "807dda1b4ab3d01:0"
Vary: Accept-Encoding
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 2441

GET
H/1.1 200
OK grid2.css
zaytung.com/yenitasarim/ 538 B
618 B 152ms
133ms Stylesheet
text/css 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/yenitasarim/grid2.css
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 4674c2d821358b062113b57e17d6b8442cf3f11337c4728a79013b31822d9ef2

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Mar 2015 22:10:34 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "83f715844867d01:0"
Vary: Accept-Encoding
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 325

GET
H/1.1 200
OK style2.css
zaytung.com/yenitasarim/ 4 KB
2 KB 134ms
115ms Stylesheet
text/css 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/yenitasarim/style2.css
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: af5bc8f15add982310c83f99974ad60334e4d3cb98ccbe27d15ab10de7d494b4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Sun, 07 Jan 2018 22:00:38 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "04779f3288d31:0"
Vary: Accept-Encoding
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 1325

GET
H/1.1 200
OK jquery.min.js Show response
zaytung.com/yenitasarim/js/ 89 KB
32 KB 152ms
133ms Script
application/x-javascript 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to

Full URL: http://zaytung.com/yenitasarim/js/jquery.min.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: */*
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Dec 2011 17:10:42 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "09588d170b3cc1:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 32168

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 34ms
17ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b70aa192cf670ffbccd24885ff71e159e03c809b890abe15e74cce9f497dd8e5

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 3109
etag: W/"3e792b2dc76a5a063e1c4f30d40ae527"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6804c9641cb2435d-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Fri, 20 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 139 KB
49 KB 29ms
23ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35483321fa1ce3b89cad3c0f96e9563a4ace00810ff296ba92c58a11215b9131

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 11489720634104672687
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 49899
X-XSS-Protection: 0
Expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H2 200 adx Show response
pubads.g.doubleclick.net/gampad/ 272 B
643 B 162ms
92ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/adx?iu=/145027374/zay_01&sz=1x1&pre=1&m=text/javascript

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

c73c9d1171d61eed712da613c8c70057ea0d058f07ecfadf9515c48a76e2a067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 142
x-xss-protection: 0
google-lineitem-id: 5093581330
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138273228194
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK zaytung_logo3.png
zaytung.com/yenitasarim/ 8 KB
8 KB 70ms
69ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/yenitasarim/zaytung_logo3.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 47151829dd2d70e1a2164209e1dd73d4c1edf5cf814b6d8d7e39f2cb6f4f70fe

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Tue, 14 Feb 2012 00:00:24 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "61280a6abeacc1:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 8139

GET
H/1.1 200
OK photo-camera.png
zaytung.com/yenitasarim/ 666 B
913 B 78ms
78ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/yenitasarim/photo-camera.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: a99cb46cfa6511ac1cfbef44287c6cbd0c213eff46c225a90555c939b0acf352

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Thu, 08 Jun 2017 12:01:08 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "77cedfe94ee0d21:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 666

GET
H/1.1 200
OK erdogan_cay_marmaris.jpg
zaytung.com/fotos/ 28 KB
28 KB 68ms
68ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/erdogan_cay_marmaris.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 0c20cb6dfa1eec472f1358de556e4f52ef3d0077c6d013228b80b8e3608b082f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sat, 31 Jul 2021 20:08:27 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "32661dd34786d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 28754

GET
H/1.1 200
OK SonDakika-GenericMini-50Red2.jpg
zaytung.com/images/ 6 KB
7 KB 68ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/SonDakika-GenericMini-50Red2.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 432880562e769f47fc030ff17cf9dff715022a1b6084d06f4b6fab0012c5e2d4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 19 May 2017 03:09:11 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "6373db494dd0d21:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 6501

GET
H/1.1 200
OK 02_zaytung-poweredbyradore_300x30.png
zaytung.com/images/ 11 KB
11 KB 68ms
67ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/02_zaytung-poweredbyradore_300x30.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: d98b97044f4765f7e0d079ac6d838652d73653aa8fef4001ebe80eab5f4e99cd

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 15 May 2017 01:05:49 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "56fd286417cdd21:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 10945

GET
H/1.1 200
OK Screenshot_20210816-215521_Sputnik.jpg
zaytung.com/fotos/ 88 KB
88 KB 81ms
76ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/Screenshot_20210816-215521_Sputnik.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: a200d1f3477d0a98d18cca8f92551b9eef5c666dff555d9ad106d9a58fe22797

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 16 Aug 2021 18:59:17 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "d43f70d0d092d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 89755

GET
H/1.1 200
OK 386AB5D7-9F8F-42E0-BE62-9C1CF6A1113D.jpeg
zaytung.com/fotos/ 218 KB
218 KB 67ms
66ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/386AB5D7-9F8F-42E0-BE62-9C1CF6A1113D.jpeg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: d25e323948e70c62a01ef4b7e13f006669f45f53a10f488dbd28603b167dabea

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 16 Aug 2021 18:19:05 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "51d66832cb92d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 223481

GET
H/1.1 200
OK zaytung_sinema_yaz_dizileri.jpg
zaytung.com/fotos/ 151 KB
152 KB 67ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/zaytung_sinema_yaz_dizileri.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 064ab2f7de7a6fccb0f068fde0120d3419ef182d7e6b6ba8f42759c0fd4853d5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Thu, 15 Jul 2021 22:43:18 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "66c5dceca79d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 154988

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ 9 KB
4 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37bfceb04cc7a18df0c1da8269c382b3b088e870ab39a0987ae17a54589b2dba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3317
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4105
x-xss-protection: 0
last-modified: Wed, 04 Aug 2021 13:52:44 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 17 Aug 2021 18:02:29 GMT

GET
H/1.1 200
OK img
app.pubserver.adhood.com/ 0
479 B 196ms
123ms Image
text/html 31.186.16.22
TURKTICARET-AS1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://app.pubserver.adhood.com/img?12996

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

31.186.16.22 , Turkey, ASN197720 (TURKTICARET-AS1, TR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache
Connection: close
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Friends-Reunion.jpg
zaytung.com/fotos/ 80 KB
80 KB 111ms
110ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/Friends-Reunion.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: e695cb628751f27517b7ae49430028756a9e7aa6377f12c52736d8545787bb2b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 24 May 2021 16:15:22 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "247177ffb750d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 82042

GET
H/1.1 200
OK Ahmad.jpg
zaytung.com/voicepics// 74 KB
74 KB 77ms
77ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/voicepics//Ahmad.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: a462488cb579d7e57e49b3288366722b5527cd24ea90b84937e1e9da0a819ae4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sat, 18 Jun 2011 00:52:12 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "a859ef5512dcc1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 75355

GET
H/1.1 200
OK oyku_kitaplari_zaytung_kitap.jpg
zaytung.com/fotos/ 148 KB
149 KB 83ms
82ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/oyku_kitaplari_zaytung_kitap.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ee0f6532ab07489af2489aa7d372170e060241a0b4a935c3be295f95ef775a3c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 04 Dec 2020 00:22:17 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "d8b7c085d3c9d61:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 151868

GET
H/1.1 200
OK formula_1_keyif.jpg
zaytung.com/fotos/ 88 KB
88 KB 76ms
76ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/formula_1_keyif.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: fa3aced85c09af999107819091cad6b2303651533d0c26081853f08aa25196b5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sun, 15 Nov 2020 20:16:26 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "f26d2e328cbbd61:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 90184

GET
H/1.1 200
OK zaytung_dergi_minimalizm_ocak2020.jpg
zaytung.com/mags/ 253 KB
254 KB 68ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/mags/zaytung_dergi_minimalizm_ocak2020.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8760a95222231fb57b846faf7443f460c46dbd70ed5867f0a79b858fedb718b0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sat, 16 Jan 2021 14:38:10 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "7ac723615ecd61:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 259391

GET
H/1.1 200
OK anket_nolmus_zaytung.jpg
zaytung.com/fotos/ 117 KB
117 KB 69ms
68ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/anket_nolmus_zaytung.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 703b635538fee4e4769fee4230187192ff538f2057e4b40b2091688f4a04ed11

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Tue, 02 Jul 2019 20:59:08 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "d986ffe1831d51:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 119864

GET
H/1.1 200
OK zz.png
zaytung.com/images/ 2 KB
2 KB 77ms
76ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/zz.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 22f39fe4943f46a43d768c45e783e37027955efa064887342bc1dd6c572febbc

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 05 Feb 2016 02:20:41 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "709f87cfbb5fd11:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2159

GET
H/1.1 200
OK zaytung_zone_banner.jpg
zaytung.com/fotos/ 59 KB
59 KB 68ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/zaytung_zone_banner.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: aa689c0e4e38cb416aaa5b5f28546387fe1f643bb22c608c818e99315cdba3e5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Wed, 22 Nov 2017 11:56:45 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "72e4df88863d31:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 59937

GET
H/1.1 200
OK s-c7da94df4264f9e72450aee0595911e2189c02f6.jpg
zaytung.com/fotos/ 54 KB
54 KB 67ms
66ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/s-c7da94df4264f9e72450aee0595911e2189c02f6.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 9ce3ddea4d143d1c088fd35a2d7bd605b615df2706fad79ab50211ba95386553

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 18 Feb 2019 20:04:16 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "2e8a8920c5c7d41:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 55182

GET
H/1.1 200
OK whatsapp_telegram(1).jpg
zaytung.com/fotos/ 59 KB
59 KB 68ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/whatsapp_telegram(1).jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 4af89a39d6c28fd65cbe8d1bad3515280ebdf0430e6633ce59d0920a904ca817

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Tue, 17 Aug 2021 17:26:14 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "80c78fb8c93d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 60534

GET
H/1.1 200
OK bozkurt_hes.jpg
zaytung.com/fotos/ 137 KB
138 KB 102ms
100ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/bozkurt_hes.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ff454325c19246b9f3278830b5e904cd1aa56612629b830139f14dcb9f545b65

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 13 Aug 2021 21:06:03 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "8b16c168790d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 140733

GET
H/1.1 200
OK askerler.jpg
zaytung.com/video/ 29 KB
29 KB 100ms
97ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/video/askerler.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ada8ea66db68729537690a16c0eba1d113412ea27672dd0d7b27f3bdcaefc249

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Thu, 21 Oct 2010 16:26:50 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "1e2b3c33c71cb1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 29562

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 15ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.twitter.com/widgets.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67D3) /
Resource Hash: 8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:34:57 GMT
Server: ECS (frb/67D3)
Age: 361
Etag: "d405b816322f9770c70cbd10cfa87be4+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28872

GET
H/1.1 200
OK D6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A.jpeg
zaytung.com/fotos/ 326 KB
326 KB 99ms
97ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/D6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A.jpeg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 1420c2a616574cf59aa85c88ff8a38a16592a4fdcbea26639b5deeeea2452251

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sat, 14 Aug 2021 08:09:22 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "a8e364b0e390d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 333356

GET
H/1.1 200
OK images-01.jpeg
zaytung.com/fotos/ 69 KB
70 KB 77ms
76ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/images-01.jpeg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: bb0d67c1ebc875aa6814d669702d9b56529ff1f9a39f8aaed99c932cb77d3978

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 16 Aug 2021 16:52:45 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "fef6eb22bf92d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 71033

GET
H/1.1 200
OK turkiye_yunanistan_ucak_yangin.jpg
zaytung.com/fotos/ 110 KB
110 KB 67ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/turkiye_yunanistan_ucak_yangin.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 5cafed99d91d73a4da8fcd78baaa3142525f0cadad7c04f6e7f8e63ee78eea42

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 09 Aug 2021 20:04:00 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "57674b2598dd71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 112796

GET
H/1.1 200
OK dingonun%20ahiri.jpg
zaytung.com/fotos/ 279 KB
280 KB 67ms
66ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/dingonun%20ahiri.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 653046b55dfe454613335784e2dd042cdb70ff30b31f28cf42c683aca28159aa

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Mon, 09 Aug 2021 07:19:25 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "d385ffe1ee8cd71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 286022

GET
H/1.1 200
OK afgan_multeciler_acizlik.jpg
zaytung.com/fotos/ 111 KB
111 KB 69ms
68ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/afgan_multeciler_acizlik.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b824ef7d09b98c5461a1b0b8dea0ea64888b745b72a7d446981ccde790f6ff4e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 06 Aug 2021 18:02:22 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "f030c534ed8ad71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 113774

GET
H/1.1 200
OK ulusal_gurur.jpg
zaytung.com/fotos/ 107 KB
107 KB 77ms
77ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/ulusal_gurur.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: c5185a8306597c98061216e7c54266a0b9a1d91f83deeefc4d16469d89cdee3e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Tue, 03 Aug 2021 19:06:19 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "289925a49a88d71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 109683

GET
H/1.1 200
OK zaytung-blog-sosyal-medyaniz-saha-kalksin-kapak(1).jpg
zaytung.com/fotos/ 90 KB
91 KB 69ms
68ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/fotos/zaytung-blog-sosyal-medyaniz-saha-kalksin-kapak(1).jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: f96aad074a7a9e65d9e5a73bfa899c14bd560113713d1a35d188e0b2657eb0de

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 09 Apr 2021 20:17:38 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "c71af7627d2dd71:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 92543

GET
H/1.1 200
OK isimsiz.jpg
zaytung.com/voicepics// 31 KB
31 KB 90ms
90ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/voicepics//isimsiz.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8557661574bfb28b6b8e4a66db193764cfcfbf44810a1b2ffb415cbfda2b1f5c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sat, 13 Apr 2013 16:07:55 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "3f9e2ef6138ce1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 31812

GET
H/1.1 200
OK radore_footer.jpg
zaytung.com/images/ 4 KB
4 KB 67ms
66ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/radore_footer.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b37047449af1e9f125a38fea044a6b44cf3da8d1050cd8cef53b8c2240371166

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Thu, 21 Apr 2011 04:29:27 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "6eae85b3dcffcb1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 3613

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/ 149 KB
51 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/cb=gapi.loaded_0?le=ili,ipu

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1157556a79b9b9ed1f42f16a1b72326d21a57cf5efcef8c4d3b54264d2d4b94c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 09:35:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30111
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52298
x-xss-protection: 0
last-modified: Wed, 07 Jul 2021 13:43:54 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 09:35:55 GMT

GET
H2

200

sdk.js Show response
connect.facebook.net/tr_TR/
Redirect Chain

http://connect.facebook.net/tr_TR/sdk.js
https://connect.facebook.net/tr_TR/sdk.js

3 KB
2 KB

15ms
6ms

Script
application/x-javascript

2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/tr_TR/sdk.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

75a4d4a38e32ddb5c936253543fb8fce75e705a2f791442c4fec59966a3c0703

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 7YJlr1BpK9wFZOcG/7FP/A==
cross-origin-resource-policy: cross-origin
expires: Tue, 17 Aug 2021 18:08:12 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: 7d9pqShgBxZF4Es2B3BipLF7uDnkGDq+rBUHC8OSws+ZNZQo5o4QonsF4Gmjq0bdAWkctiTUX33YaaCBAiZBAw==
x-fb-trip-id: 686109401
x-fb-content-md5: 95f5ebb6559f97545bafd61346627b71
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Tue, 17 Aug 2021 17:57:46 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "da63380b9c9612aca4a09e11a01ebcba"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

Redirect headers

Location: https://connect.facebook.net/tr_TR/sdk.js#xfbml=1&version=v2.8&appId=1554908878104117
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK gpt.js Show response
www.googletagservices.com/tag/js/ 71 KB
25 KB 20ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c9cfaba05ff6f55834fb13668202d553b54919175cc7ecb85747cefd117cae9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "961 / 20 of 1000 / last-modified: 1629209265"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin: *
Content-Length: 25185
X-XSS-Protection: 0
Expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H3-29 200 sdk.js Show response
connect.facebook.net/tr_TR/ 230 KB
67 KB 15ms
15ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Requested by

Host: connect.facebook.net
URL: http://connect.facebook.net/tr_TR/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

065c36f31d6182f255b92d155783e80529680ab90f4ed3029b96269be6306321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: http://zaytung.com
Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: vYe1BMby2Rx7TfHebRnwow==
cross-origin-resource-policy: cross-origin
expires: Wed, 17 Aug 2022 16:57:44 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68311
x-fb-rlafr: 0
x-fb-debug: EvTO+CbDYqAVjNTRdrGsLniN5p8qfBK1feVxyy/RNhOBxCAna3H1UCiO93E6HRsIs69UcHp1I1zsyERKWLoHkw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
x-fb-content-md5: 4e3fdfbd696b48406cb39d01f3d5202c
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 17 Aug 2021 17:57:46 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "7a891b69fde4d88bc8c1c78e2422524a"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 pubads_impl_2021081201.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
115 KB 38ms
37ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

01e51940762b45561e5a0c1ea5e5ad122f4c732178d0cb428f8f4409030efb13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Aug 2021 08:42:15 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117424
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK adRecover.js Show response
delivery.adrecover.com/29789/ 33 KB
12 KB 35ms
19ms Script
application/javascript 2606:4700::6812:353
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://delivery.adrecover.com/29789/adRecover.js?ts=1504060433868
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 2606:4700::6812:353 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e46698f08149fcc909ea36303726078324e20517cd03cdeb10dba4f90bbc0051

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 17 Aug 2021 07:01:22 GMT
Server: cloudflare
Age: 38929
ETag: W/"611b5ec2-847c"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=432000
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 6804c9657f9c4eb0-FRA
Expires: Sun, 22 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK loader.js Show response
cdn.taboola.com/libtrc/zaytung/ 218 KB
26 KB 63ms
38ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://cdn.taboola.com/libtrc/zaytung/loader.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 63e1df56cd8fd8e4b27104a1e32b04212e0f621f0577854087df44e88d8ce24d

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: pITkwjeN6soFxMq_VPwuNco6x_8luCoI
Content-Encoding: gzip
ETag: "98605a0bf0ad7f2c5adc289926c8691e"
Age: 10023
X-Cache: HIT
Connection: keep-alive
Content-Length: 25959
x-amz-id-2: NI41OimnrnnAuv1njs79Hc8lr+VmvmGSKnUKy1I2TXxvZbv6fe0Qq/qUNSDEAnYk1hGBxnCZKHA=
X-Served-By: cache-fra19141-FRA
Last-Modified: Tue, 17 Aug 2021 15:10:21 GMT
Server: AmazonS3
X-Timer: S1629223067.505320,VS0,VE0
Date: Tue, 17 Aug 2021 17:57:46 GMT
Vary: Accept-Encoding
x-amz-request-id: EJA4AE032TTQYMT0
Via: 1.1 varnish
Cache-Control: private,max-age=14401
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
abp: 98
X-Cache-Hits: 4

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zaytung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 17ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zaytung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 92 KB
18 KB 170ms
133ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=790460311999216&correlator=4008676945093458&output=ldjh&impl=fifs&eid=31062275%2C20211866%2C31062297&vrg=2021081201&ptt=17&sc=0&sfv=1-0-38&ecs=20210817&iu_parts=131302407%2CZaytung&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1&prev_iu_szs=728x90%2C300x250%2C300x250%2C160x600%2C160x600%2C980x250%2C1x1%2C1x1%2C1x1%2C1x1&prev_scp=size%3D728x90%7Csize%3D300x250%7Csize%3D300x250-2%7Csize%3D160x600%7Csize%3D160x600-2%7Csize%3DMasthead%7Csize%3DPageskin%7Csize%3DPrestitial%7Csize%3DAdv-Okunma%7Csize%3DAdv-Goruntulenme&cust_params=zaytung_kategori%3Dsite_geneli&cookie_enabled=1&bc=23&abxe=1&lmt=1629223066&dt=1629223066488&dlt=1629223065944&idt=513&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C310%2C-9%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C0%2C-9%2C-9%2C-9&adks=3891160079%2C148604258%2C2711363484%2C1460248415%2C2307278459%2C3713588657%2C394331224%2C2771283406%2C764255242%2C804770314&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&vis=1&scr_x=0&scr_y=0&psz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C980x0%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C980x0%7C0x-1%7C0x-1%7C0x-1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=false&fws=2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C0%7C-1%7C-1%7C-1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

27b16607878ee37c98fab6b48374fa3e23907433e013250f050aa183b4861e3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18836
x-xss-protection: 0
google-lineitem-id: 173858807,4389650325,173859047,-2,-2,173859287,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 97089013247,138208638633,97089015407,-2,-2,97089014927,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://zaytung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6B13 6 KB
3 KB 51ms
14ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 17:57:46 GMT
expires: Wed, 17 Aug 2022 17:57:46 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

7ms
7ms

Script
text/javascript

2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 4223
date: Tue, 17 Aug 2021 16:47:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 17 Aug 2021 18:47:23 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108100101/ 252 KB
94 KB 52ms
32ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108100101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4285561087574024&plah=zaytung.com

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

137bdadd875cc13a2fd1fedba8caafe72fb14e7fa3418504763bba06bf27f500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95569
x-xss-protection: 0
server: cafe
etag: 15041329415598805064
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210812/r20190131/ Frame 9260 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210812/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5f3085127d154cbd72e219052312767d460633fafa6e38bb9a9446ddb03a270

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210812/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 16 Aug 2021 20:11:15 GMT
expires: Mon, 30 Aug 2021 20:11:15 GMT
content-type: text/html; charset=UTF-8
etag: 8999110079160743657
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4576
x-xss-protection: 0
age: 78391
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK img.fetch Show response
udmserve.net/udm/ 18 KB
4 KB 646ms
167ms Script
application/x-javascript 68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to

Full URL: https://udmserve.net/udm/img.fetch?sid=14256;tid=1;ev=1;dt=6;
Requested by: Host: pubads.g.doubleclick.net
URL: https://pubads.g.doubleclick.net/gampad/adx?iu=/145027374/zay_01&sz=1x1&pre=1&m=text/javascript
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: bcaee944cb8308960f791826aad84abbd1bcfa0bf7b1a3c33437e09dd29d9809

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:47 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3p: NOI DSP CURa ADMa DEVa PSAa PSDa OUR IND UNI COM NAV INT
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Content-Type: application/x-javascript
Expires: 0

GET
H2

200

ad.js Show response
trgde.adocean.pl/__/_1629223066560/
Redirect Chain

https://trgde.adocean.pl/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
https://trgde.adocean.pl/__/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=

3 KB
1 KB

35ms
35ms

Script
application/x-javascript

92.222.208.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://trgde.adocean.pl/__/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.208.206 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
Software: GAD /
Resource Hash: 69d4b0c67bb13a4a4e0979f58ccdbd88722203f2dab96ea2af819c4467d98cf8

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
server: GAD
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 912
expires: Mon, 16 Aug 2021 17:57:46 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:46 GMT
server: GAD
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 0
expires: Mon, 16 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK vhback.png
zaytung.com/images/ 3 KB
3 KB 76ms
66ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/vhback.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 7c4387c6c82fa5a0e9e3a5d4de97527ae5daf90de345cec794571fb8c8cb3b1e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Wed, 02 Nov 2016 14:06:07 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "d1671411235d21:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2986

GET
H/1.1 200
OK block.jpg
delivery.adrecover.com/ 631 B
1 KB 13ms
12ms Image
image/jpeg 2606:4700::6812:353
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://delivery.adrecover.com/block.jpg?ts=1629223066586
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 2606:4700::6812:353 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
CF-Cache-Status: HIT
Age: 121416
Connection: keep-alive
Content-Length: 631
Last-Modified: Wed, 23 Jun 2021 06:37:54 GMT
Server: cloudflare
ETag: "60d2d6c2-277"
Vary: Accept-Encoding
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Expires: Sun, 22 Aug 2021 17:57:46 GMT
Cache-Control: public, max-age=432000
Accept-Ranges: bytes
CF-RAY: 6804c966295f4eb0-FRA
Cf-Bgj: h2pri

GET
H2 200 impl.20210817-13-RELEASE.js Show response
cdn.taboola.com/libtrc/ 526 KB
117 KB 97ms
34ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/zaytung/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 7957504f907ffedfc0d7ec27f93664a47d4d36b36ece1386e74492f753d24025

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: TUSbl2l40svWfFlJVwXYPuHPAYztwB_9
content-encoding: br
etag: "01b707a86593ca856ebf2a0f0e6660df"
age: 11085
x-cache: HIT
content-length: 119131
x-amz-id-2: SJFl3emlXaODWt+FNX9JGwX4194FWDOq8QH092XapRhZ7G1it8VYVpihCOnA9OwTQVpjvnfZKns=
x-served-by: cache-fra19148-FRA
last-modified: Tue, 17 Aug 2021 14:51:27 GMT
server: AmazonS3-br
x-timer: S1629223067.676135,VS0,VE0
date: Tue, 17 Aug 2021 17:57:46 GMT
vary: Accept-Encoding
x-amz-request-id: QFVX0N7VDPX5JD4E
via: 1.1 varnish
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: application/javascript
abp: 57
x-cache-hits: 45318

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=203177410&utmhn=zaytung.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Zaytung%20...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=203177410&utmhn=zaytung.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Zaytung%2...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-11942895-1&cid=648631566.1629223066&jid=1374516380&_v=5.7.2&z=203177410

35 B
113 B

15ms
14ms

Image
image/gif

2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-11942895-1&cid=648631566.1629223066&jid=1374516380&_v=5.7.2&z=203177410

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 17 Aug 2021 17:57:46 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:46 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-11942895-1&cid=648631566.1629223066&jid=1374516380&_v=5.7.2&z=203177410
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 369
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 201 B
257 B 50ms
50ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=zaytung.com&callback=_gfp_s_&client=ca-pub-4285561087574024

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108100101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4285561087574024&plah=zaytung.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

7a2bd9ab7b0238e27e599bef54782c0f28ee81718040506121ad25c6e7c9d1f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 39ms
20ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 38ms
36ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B780 23 KB
1 KB 115ms
114ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&adk=1812271804&adf=3025194257&lmt=1629223066&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&ea=0&flash=0&pra=5&wgl=1&dt=1629223066523&bpp=3&bdt=579&idt=108&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1884844164231&frm=20&pv=2&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=11&uci=a!b&fsb=1&dtd=121

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60c249056e1e2a6ca061e5ccde6b56c4de267a6e911500eb17aa2d3e13d5f19d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&adk=1812271804&adf=3025194257&lmt=1629223066&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&ea=0&flash=0&pra=5&wgl=1&dt=1629223066523&bpp=3&bdt=579&idt=108&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1884844164231&frm=20&pv=2&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=11&uci=a!b&fsb=1&dtd=121
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:46 GMT
server: cafe
content-length: 1228
x-xss-protection: 0
set-cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; expires=Sun, 11-Sep-2022 17:57:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:46 GMT
cache-control: private

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 30ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe4436f1d882b3acd98fb2763984bacd382664582f4918647b89894f46b871

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113446242536"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27733
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:46 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 060A 107 KB
38 KB 383ms
380ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3b4bd8e280d9d0e7d65e47e73dd4544323ba0e2c5211559a28eaa87df8c28bac

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJb0mfHQuPICFUviGwodVv4DOg&gqi=mvgbYbHsKabgnsEP_Li-gAM&layout=/sadbundle/%24csp%253Der3%24/5165121183719721941/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmzW9Be2J6UFuhq4le2s27JxA4e_5VbaamOkQvtl3zMPtpv_P3EBznbbQ017Ec
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJb0mfHQuPICFUviGwodVv4DOg&gqi=mvgbYbHsKabgnsEP_Li-gAM&layout=/sadbundle/%24csp%253Der3%24/5165121183719721941/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 38851
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EA98 107 KB
38 KB 525ms
525ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbc4c4bd5bf61345f0093760b5d071fd6dbded304f0865db661162a49dfacec8

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI-ymvHQuPICFQ6ChQodAAgI3Q&gqi=mvgbYe2pKq60nsEPnMO6oAQ&layout=/sadbundle/%24csp%253Der3%24/10023993934787577230/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmzW9Be2J6UFuhq4le2s27JxA4e_5VbaamOkQvtl3zMPtpv_P3EBznbbQ017Ec
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI-ymvHQuPICFQ6ChQodAAgI3Q&gqi=mvgbYe2pKq60nsEPnMO6oAQ&layout=/sadbundle/%24csp%253Der3%24/10023993934787577230/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 38941
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 xgde.js Show response
gdetr.hit.gemius.pl/gdejs/ 54 KB
19 KB 119ms
35ms Script
application/x-javascript 92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/gdejs/xgde.js
Requested by: Host: trgde.adocean.pl
URL: https://trgde.adocean.pl/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: e25b605ba1adfb5e38e4342ead7253da4b9ab9871b3c22ebb26ee6b624dce4eb

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
last-modified: Wed, 14 Apr 2021 06:33:51 GMT
server: GHC
etag: "60768CCF0000D7B32E93DA3F"
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 19239
expires: Wed, 18 Aug 2021 17:57:46 GMT

GET
H2 200 Paribu_Bannev2-300x250.jpg
trgde.adocean.pl/files/akimnjxkmmy/xnfljoquab/yeqqmrlkzc/ 38 KB
38 KB 56ms
55ms Image
image/jpeg 92.222.208.206
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trgde.adocean.pl/files/akimnjxkmmy/xnfljoquab/yeqqmrlkzc/Paribu_Bannev2-300x250.jpg
Requested by: Host: trgde.adocean.pl
URL: https://trgde.adocean.pl/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.208.206 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
Software: GAD /
Resource Hash: 1158d8967fc1ccb1b4570f534ea9df97bd5a8a6c6752399fbdfc652a716dd6b3

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
last-modified: Thu, 12 Aug 2021 12:03:30 GMT
server: GAD
etag: "61150E120000968477464693"
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: public, must-revalidate, max-age=4320000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-type: image/jpeg
content-length: 38532
expires: Wed, 06 Oct 2021 17:57:46 GMT

GET
H2 200 inscreen_lib.js Show response
gdetr.hit.gemius.pl/gdejs/ 25 KB
10 KB 119ms
35ms Script
application/x-javascript 92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/gdejs/inscreen_lib.js
Requested by: Host: trgde.adocean.pl
URL: https://trgde.adocean.pl/_1629223066560/ad.js?id=CBrlP159LevwFkBZPZjgVklo3_TQKi9eMsSh04syQNf.D7/nc=0/gdpr=0/gdpr_consent=/redir=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: c3b1ca5d98d4076ec5875d96d79179647df3148e16005ec6c2b7e131eabecbb5

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
last-modified: Wed, 28 Nov 2018 10:03:50 GMT
server: GHC
etag: "5BFE68060000651BD04AF2C1"
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 9748
expires: Wed, 18 Aug 2021 17:57:46 GMT

GET
H/1.1 200
OK fhback.png
zaytung.com/images/ 13 KB
13 KB 116ms
116ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/fhback.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 819a75e614fd73dfe8100a8f0ed2724b8caef5f5efa94aca54d745a3f88b2d97

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Wed, 29 Sep 2010 16:46:12 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "41da28d3f55fcb1:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 13552

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 24ms
24ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1CAA 61 KB
29 KB 524ms
524ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a949fb539e189568b1f490aca4a66fc8024032d692ad4d71d73a13edd8e92d0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 29304
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 impl_v78.js Show response
www.googletagservices.com/dcm/ 37 KB
15 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v78.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07000140ab52c28ef2a522fae638638b2783786e8e2ae8cb883cc1f0a0c00df0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 16 Aug 2021 19:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82518
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15595
x-xss-protection: 0
last-modified: Thu, 29 Jul 2021 17:50:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 16 Aug 2022 19:02:29 GMT

GET
H/1.1 200
OK snmback.png
zaytung.com/images/ 7 KB
7 KB 68ms
67ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/snmback.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 150fa898a18e060aca2b25111ce1c3684bba1a7b71e0f17c1f30efe942a6b2ee

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Sun, 15 Feb 2015 19:12:04 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "b1e07c485349d01:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 6794

GET
H/1.1 200
OK astroback.gif
zaytung.com/images/ 17 KB
17 KB 67ms
67ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/astroback.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 3879cfab5c83e980dd5fc9fa54947406126dab477cdbcf39478340fe8251f536

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:46 GMT
Last-Modified: Fri, 20 Nov 2009 00:04:21 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "36ec237569ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 17158

GET
H2 200 B26054011.307513330;dc_ver=78.226;sz=320x100;u_sd=1;nel=1;dc_adk=515846942;ord=0x2rnk;dc_rfl=0,http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636$0;xdt=0;crlt=LF1hd2)_w';osda=2;sttr=24... Show response
ad.doubleclick.net/ddm/adj/N6662.3406979GENARTMEDYA/ 54 KB
23 KB 132ms
63ms Script
text/javascript 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N6662.3406979GENARTMEDYA/B26054011.307513330;dc_ver=78.226;sz=320x100;u_sd=1;nel=1;dc_adk=515846942;ord=0x2rnk;dc_rfl=0,http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636$0;xdt=0;crlt=LF1hd2)_w';osda=2;sttr=24;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v78.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f6.1e100.net

Software

cafe /

Resource Hash

174c0f93c5b7e81d6c9616c4991a3f493be0e4b7c6165d52d578c567a95fe5c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23009
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xgde.html Show response
gdetr.hit.gemius.pl/gdejs/ Frame 104D 303 B
360 B 38ms
35ms Document
text/html 92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/gdejs/xgde.html
Requested by: Host: gdetr.hit.gemius.pl
URL: https://gdetr.hit.gemius.pl/gdejs/xgde.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: 7bbd910982260037f1c9d83f2c7fe743e789ca06dd54c9eb56c2598b7b928fd0

Request headers

:method: GET
:authority: gdetr.hit.gemius.pl
:scheme: https
:path: /gdejs/xgde.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
expires: Wed, 18 Aug 2021 17:57:47 GMT
server: GHC
accept-ranges: none
cache-control: public, max-age=86400
last-modified: Fri, 18 Aug 2017 12:03:49 GMT
etag: "5996D7A50000012F9178E011"
vary: Accept-Encoding,Origin
cross-origin-resource-policy: cross-origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
content-type: text/html;charset=utf-8
content-length: 215
content-encoding: gzip

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 060A 18 KB
8 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 060A 2 KB
1 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 060A 124 KB
37 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 060A 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 060A 0
0 16ms
15ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQHO6rRHPeeP8C0nmFVe_AScTbMaoMk2IE3et2b7jrpdHUI_wQMJXIplYIIVbbWsNHPg09uYMhMKcIvzdgwVjK_HUseYw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/ Frame 8D4B 48 KB
23 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

944015d1bcfbf0e1922312e698422df1e76313a8d3d2e39fe3422d9fee05cbf2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/5165121183719721941/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 17 Aug 2021 04:41:46 GMT
expires: Wed, 17 Aug 2022 04:41:46 GMT
last-modified: Fri, 22 May 2020 11:04:54 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 23964
age: 47761
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 060A 0
0 31ms
30ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C65mbmvgbYZa_KsvEb9b8j9AD4rLX8WOnqb20ygzhipGZ9BkQASD1lLgVYJUCoAHXl-y6AsgBCakC2kG_YwC0sz6oAwHIA0iqBPMBT9BReDkYyYDnf6n7LPMIrHwZpT5oOAzxqqniRzKS7ryBognu21ZDmEGyWvqr9153IUQf93wh8z3LqEOPOL9Xaps4U3zubzxUOZHUDYlmewPkYnudHRcirJ0fo-edVymYtDFuWpDd61UGYUZBFobAAC7t3U8BZgJ_EGMPMPBe2LjXGDwundWa0VmHvufi3TK921pk05qKKXZdTjrhKPZxXWPqeKyzHaBWM8I8M1vVaE45DNHN-z-zpiwkmOHlp1H4X2XgH5aL6EtM0D-7AcspHrIfYhvlJeJO4D3IYzmGIzct-zWB3hyrRVjC6FeSVcCQch7FwATGidCj_wKSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHkeiTxQGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQkq4F0ggJCIDhgBAQARgfgAoByAsB2BMNiBQC0BUBmBYBgBcBshccChoIABIUcHViLTQyODU1NjEwODc1NzQwMjQYAA&sigh=SMsI9HmwPC8&template_id=419

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6048 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=9938915495&adk=3920710080&adf=1049857893&pi=t.ma~as.9938915495&w=160&lmt=1629223066&psa=0&format=160x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066526&bpp=3&bdt=582&idt=123&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=148&ady=80&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfE%7C&abl=CF&pfx=0&fu=0&bc=23&ifi=12&uci=a!c&fsb=1&xpc=T2722oOhQl&p=http%3A//zaytung.com&dtd=137

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:42:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 890
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 060A 0
20 B 57ms
41ms Other
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJb0mfHQuPICFUviGwodVv4DOg&gqi=mvgbYbHsKabgnsEP_Li-gAM&layout=/sadbundle/%24csp%253Der3%24/5165121183719721941/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 8D4B 9 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 23:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67919
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 23:05:48 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 8D4B 26 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84394
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:31:13 GMT

GET
H2 200 tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8D4B 109 KB
37 KB 38ms
15ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36c0ec05d79bd9d3164effc3eca0f1962cd6f82bb1f41cb212e080910be24153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37530
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:51:14 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
DATA 200
OK truncated
/ Frame 060A 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be1a3d0306d7660043c43c7f0bbdd8d0effc7dba81be0191ed0e561b6538795c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8D4B 5 KB
0 Font
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/plain;charset=US-ASCII

GET
DATA 200
OK truncated
/ Frame 8D4B 10 KB
0 Font
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/plain;charset=US-ASCII

GET
DATA 200
OK truncated
/ Frame 8D4B 3 KB
0 Font
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: null
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/plain;charset=US-ASCII

GET
H3-29 200 5ea98cc9e7a03d000f7927c6.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/ Frame 8D4B 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/5ea98cc9e7a03d000f7927c6.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eea89dc96df1b533e47cf2e7201810770a327e6b972f3c531bb3f8c3e87cf6fd

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 36989
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2117
x-xss-protection: 0
last-modified: Fri, 22 May 2020 11:04:54 GMT
server: sffe
date: Tue, 17 Aug 2021 07:41:18 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 07:41:18 GMT

GET
H3-29 200 5ea98cc9e7a03d000f7927c5.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/ Frame 8D4B 35 KB
35 KB 10ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/5ea98cc9e7a03d000f7927c5.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e90fc13ca6a55830365233e16740a9d8c768951cddb0a3c5f9864e9691ba4cc2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 46640
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36117
x-xss-protection: 0
last-modified: Fri, 22 May 2020 11:04:54 GMT
server: sffe
date: Tue, 17 Aug 2021 05:00:27 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 05:00:27 GMT

GET
H3-29 200 5ec261cb9c3f8500117de642.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/ Frame 8D4B 9 KB
9 KB 9ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/5ec261cb9c3f8500117de642.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5165121183719721941/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09bb79a95989d2461e800591165b89d2ec8cd8dc52303d10f2128f224f7dfe0f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 55900
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9229
x-xss-protection: 0
last-modified: Fri, 22 May 2020 11:04:54 GMT
server: sffe
date: Tue, 17 Aug 2021 02:26:07 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 02:26:07 GMT

GET
H2 200 xgde.js Show response
gdetr.hit.gemius.pl/gdejs/ Frame 104D 54 KB
19 KB 36ms
32ms Script
application/x-javascript 92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/gdejs/xgde.js
Requested by: Host: gdetr.hit.gemius.pl
URL: https://gdetr.hit.gemius.pl/gdejs/xgde.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: e25b605ba1adfb5e38e4342ead7253da4b9ab9871b3c22ebb26ee6b624dce4eb

Request headers

Referer: https://gdetr.hit.gemius.pl/gdejs/xgde.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
last-modified: Wed, 14 Apr 2021 06:33:51 GMT
server: GHC
etag: "60768CCF0000D7B32E93DA3F"
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 19239
expires: Wed, 18 Aug 2021 17:57:47 GMT

GET
H3-29 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ 114 KB
39 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://zaytung.com
Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 07:15:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Aug 2021 07:15:07 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N6662.3406979GENARTMEDYA/B26054011.307513330;dc_ver=78.226;sz=320x100;u_sd=1;nel=1;dc_adk=515846942;ord=0x2rnk;dc_rfl=0,http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636$0;xdt=0;crlt=LF1hd2)_w';osda=2;sttr=24;prcl=s

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:53:57 GMT

GET
H/1.1 200
OK UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ 41 KB
15 KB 15ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 12:48:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 03 Mar 2020 20:15:00 GMT
Server: sffe
Age: 18543
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 15207
X-XSS-Protection: 0
Expires: Wed, 17 Aug 2022 12:48:44 GMT

GET
H/1.1 200
OK blgback.png
zaytung.com/images/ 483 B
730 B 80ms
76ms Image
image/png 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/blgback.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 241b5636b95eff1e9291d6f60c1302cd6f9031b20153aa1d2d2f2a9c0a400310

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Sat, 12 May 2012 15:35:37 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "629213e15430cd1:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 483

GET
H/1.1 200
OK anketback.gif
zaytung.com/images/ 12 KB
12 KB 69ms
66ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/anketback.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: c72c2255f9931e7a24b2fb3c1afd5e37ec8062d9af5aff7f28d7e8170fe5344b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Thu, 19 Nov 2009 23:47:08 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "3842b9b7269ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 11820

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 19ms
18ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7F0B 73 KB
28 KB 412ms
412ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5370ba1d0040794b042ef3231039061fa29b0e8f34bd12000309ee982b4031d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 28239
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK img
app.pubserver.adhood.com/ 0
479 B 158ms
138ms Image
text/html 31.186.16.22
TURKTICARET-AS1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://app.pubserver.adhood.com/img?12996

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

31.186.16.22 , Turkey, ASN197720 (TURKTICARET-AS1, TR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache
Connection: close
Content-Type: text/html
X-XSS-Protection: 1; mode=block

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame 335B 0
0 56ms
53ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvq6WDD4Ol54y2xqb2wje-S9ZngTV5gxChKOjPtNh9hyxaExaSoXbGrBMn9QbrqhUy6DyMkYM0DhMQdP2Anig3JQVyg9TpcbYymmEhpxBNCe-SmK_aMGpW1ZCi4iukNF7szTDrCJ1ZGmJJFUxGksoif6xPlk01RHMEwNCYfrLpjAea2FcwtuqPg5OVSTplXneCtdAG9QVgVrnd_yQDBvv_soCoBR19zWQR0a06GpZFCX9NQ3haQA_KlXdSXITXTT6fCxA9PmMzTjQFN9yutBh0YYAJh8hVbDsjws7EB3iP7K6SxSaA&sig=Cg0ArKJSzF1XtclkXIWKEAE&adurl=

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 335B 18 KB
7 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 335B 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 335B 124 KB
37 KB 33ms
30ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
H/1.1 204
No Content l
www.google.com/ads/measurement/ Frame 335B 0
0 15ms
13ms Image
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.google.com/ads/measurement/l?ebcid=ALh7CaSI7Owr64lkwJf4oRjgQKP5cWGIcEtbHLo1adZv9ABzP2lK7YUU7wGSnl0n-pUl57gXMXGgToPK9tJtcZc_6nD6qpF-_Q
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js
Protocol: HTTP/1.1
Server: 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 2401123243476830727
tpc.googlesyndication.com/simgad/ Frame 335B 112 KB
112 KB 11ms
8ms Image
image/gif 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2401123243476830727

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16c5aa4f740261df7ee695003ad842648230293d04af7bcb593b15a698f50d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 07:46:38 GMT
x-content-type-options: nosniff
age: 36669
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114249
x-xss-protection: 0
last-modified: Mon, 14 Aug 2017 06:44:57 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 07:46:38 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 667A 72 KB
27 KB 399ms
399ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff99c7e6025abc526fb532ed3e0e8cb7248ed4d89b8580939899374cbf230e5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 28027
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

likebox.php Show response
www.facebook.com/plugins/ Frame 0F39
Redirect Chain

http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&
https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&

14 KB
7 KB

48ms
48ms

Document
text/html

2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

45b4b694d0438e2b21240e5c27f9dbc677b0753bc9b4a3bdff2520d23ead6306

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: kaFKrcDkHMaGO01sCnSIGrUOT/qffFP2F31xdiuZ6BMd/AwCs/ihzFjhJgy2iYGr5a1qimUZvHd35e/BM+uZEw==
date: Tue, 17 Aug 2021 17:57:47 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

Location: https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK sportsback2.gif
zaytung.com/images/ 12 KB
12 KB 68ms
67ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/sportsback2.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 7a2c6d1f5e90afc6fe4855437344f11a36e35f5b812d72624d40aaca45923a47

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Fri, 20 Nov 2009 00:38:19 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "4432c8c17969ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 12430

GET
H/1.1 200
OK dergiback2.jpg
zaytung.com/images/ 1 KB
1 KB 68ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/dergiback2.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 35a6bfb03539bb92a063fd9e15a349ab2e9083a3454beac2de0aab498c7bc1f5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Wed, 12 May 2010 23:36:20 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "e61adcec2bf2ca1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 1216

GET
H/1.1 200
OK haberback2.gif
zaytung.com/images/ 10 KB
10 KB 83ms
83ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/haberback2.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b0e95c05b6a1edce180b0d4f07b11eb39545b30a44b6c8f9f2ccc6ed84134788

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Fri, 20 Nov 2009 00:20:55 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "148395537769ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 10472

GET
H/1.1 200
OK ztn_back.jpg
zaytung.com/images/ 13 KB
13 KB 67ms
67ms Image
image/jpeg 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/ztn_back.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: bdf7911fda166082a1de19e0e2d120634a2dd0b9a7a95a2bc22a7c4314476f2d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Wed, 15 Sep 2010 11:30:17 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "5e3c825fc954cb1:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 13471

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame A0F5 0
0 54ms
52ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss36AkAZt7tpnIrKYZI8wzfTEfewK0pi-_t3NECVtGvDHhYH8si1O8EoDEJkIThWvdEi8TxUhtd5DUwn14Q8JnvFA6VfnQeSL9lCFuF8Z-PuYi07I-sTU29MMMLDS5RVG1F_lbSHaCkqY6BfmigsGFEzKXylnr3e2H9RUwMFXrp6KEXqthrwuOWGusE2V7GLab8va_VH6jdFzHhLLSscxLEqHGx0e_h16lQFRKXONjmzaYCnrsjJ4LRqiLqmwLcmStYREzbmLFcCZqgiZfYb8yAet292JhZB0bmsSorcmjP9QiBJg&sig=Cg0ArKJSzLp65K7qVJjYEAE&urlfix=1&adurl=

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK adx.js Show response
s1.adform.net/banners/scripts/ Frame A0F5 58 KB
24 KB 93ms
64ms Script
application/x-javascript 37.157.5.73
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: http://s1.adform.net/banners/scripts/adx.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js
Protocol: HTTP/1.1
Server: 37.157.5.73 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 6330d93c38185b92516fd8bdb7220ff136b6817c2ef101ed7d822e122066240b

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 May 2021 15:01:38 GMT
Server: nginx
ETag: W/"609d3f52-e80f"
X-Cache-Status: HIT
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Connection: keep-alive
Content-Type: application/x-javascript
Keep-Alive: timeout=15

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A0F5 124 KB
37 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
H/1.1 200
OK fbs2.gif
zaytung.com/images/ 147 B
393 B 84ms
82ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/fbs2.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 39037126357d556f6b322b7968139fe4aa805da915507600e1da3429d7fffadb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Sat, 09 Jan 2010 17:34:28 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "0aa66fe5191ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 147

GET
H/1.1 200
OK tws3.gif
zaytung.com/images/ 191 B
438 B 68ms
67ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/tws3.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 302f1a05af908a68e88e4e42cf61b0a36cd3d01e0ba4186bd3c48d05cdb1f0ce

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Sat, 09 Jan 2010 19:27:21 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "9ef7d2c36191ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 191

GET
H/1.1 200
OK ahe.gif
zaytung.com/images/ 191 B
438 B 68ms
67ms Image
image/gif 213.128.72.10
RADORE

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zaytung.com/images/ahe.gif
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 213.128.72.10 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS: server-213.128.72.10.radore.net.tr
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: d69f83e7d24845564dcfc7131aef2d143437b84136fa2d4d371499bd2c673fb1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: zaytung.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Cookie: ASPSESSIONIDAQTTSBRD=EEPPDDGBOHLKPNMHLKOCMEFB; __utmc=247317775; __utmz=247317775.1629223067.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utma=247317775.648631566.1629223066.1629223066.1629223066.1; __utmb=247317775.1.10.1629223067; __gads=ID=ed47df7372cac525-2293584cadc90051:T=1629223066:RT=1629223066:S=ALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q
Connection: keep-alive
Cache-Control: no-cache
Referer: http://zaytung.com/fotohaberdetay.asp?newsid=395636
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Last-Modified: Sat, 09 Jan 2010 19:52:46 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "a8cfba506591ca1:0"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 191

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6048
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

48ms
48ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:47 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 17-Aug-2021 18:57:47 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:47 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:47 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK udm-r3_v2.7.10.js Show response
bid.underdog.media/ 466 KB
143 KB 40ms
19ms Script
application/javascript 2600:9000:2104:7e00:5:c4ab:c3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://bid.underdog.media/udm-r3_v2.7.10.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=14256;tid=1;ev=1;dt=6;
Protocol: HTTP/1.1
Server: 2600:9000:2104:7e00:5:c4ab:c3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f2690aca8d46b45b19d3c6755f93f53600f265113678a37ac8c335c2fb82386

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 12 Aug 2021 18:39:15 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Thu, 12 Aug 2021 18:25:38 GMT
Server: AmazonS3
Age: 429513
ETag: "6c3473f1251cd0d9801477f3a3214d04"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 8e380527758859f940c2c93ed9fbd5d8.cloudfront.net (CloudFront)
Cache-Control: max-age=2592000
X-Amz-Cf-Pop: AMS1-C1
Accept-Ranges: bytes
Content-Length: 145395
X-Amz-Cf-Id: r3iuhwSqmqYqk0usreJ12ykHao6xSKnpv4FPA7f3ZYW6Jkmldp7u3w==

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 38ms
10ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=14256;tid=1;ev=1;dt=6;
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
etag: "lp772EpWKwf8Kq7YKMhbuw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 24 Aug 2021 17:57:47 GMT

GET
H/1.1 200
OK quant.js Show response
edge.quantserve.com/ 24 KB
9 KB 20ms
7ms Script
application/javascript 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://edge.quantserve.com/quant.js
Requested by: Host: udmserve.net
URL: https://udmserve.net/udm/img.fetch?sid=14256;tid=1;ev=1;dt=6;
Protocol: HTTP/1.1
Server: 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Content-Encoding: gzip
Etag: "lp772EpWKwf8Kq7YKMhbuw=="
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: private, max-age=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Accept-Ranges: bytes
Expires: Tue, 24 Aug 2021 17:57:47 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bapnid%3D%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fudmserve.net%252Fudm%252Ffetch.pix%253Fdt%253D1%253Bapnid%253D%2524UID
https://udmserve.net/udm/fetch.pix?dt=1;apnid=6877626773716791149

43 B
595 B

319ms
156ms

Image
image/gif

68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;apnid=6877626773716791149
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:47 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 69b59d06-57da-4a01-bb36-4e538a858cdf
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://udmserve.net/udm/fetch.pix?dt=1;apnid=6877626773716791149
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://image8.pubmatic.com/AdServer/ImgSync?p=156505&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156505%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fudmserve.net%...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjVFNjgzQjgtQTc0Ni00NUI0LUFBRDQtMzBGMEU1NTc5MjlF&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156505&pmc=1&pr=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fpmid%3DB5E683B8-A746-45B4-AAD4-30F0E557929E
https://udmserve.net/udm/fetch.pix?pmid=B5E683B8-A746-45B4-AAD4-30F0E557929E

43 B
611 B

162ms
155ms

Image
image/gif

68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?pmid=B5E683B8-A746-45B4-AAD4-30F0E557929E
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://udmserve.net/udm/fetch.pix?pmid=B5E683B8-A746-45B4-AAD4-30F0E557929E
date: Tue, 17 Aug 2021 17:57:47 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 204 services
sync.technoratimedia.com/ 0
291 B 301ms
103ms Image
text/plain 129.159.70.95
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=54&cb=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bsncr%3D[USER_ID]
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 129.159.70.95 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 114667075
access-control-allow-origin: http://zaytung.com/
access-control-allow-credentials: true

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://inv-nets.admixer.net/adxcm.aspx?ssp=F74A1705-8854-4390-959E-C24FA4349F88&rurl=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Badmix%3D%24%24visitor_cookie%24%24
https://udmserve.net/udm/fetch.pix?dt=1;admix=bcf905babaae460a9cf134b3ac10ddee

43 B
608 B

161ms
157ms

Image
image/gif

68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;admix=bcf905babaae460a9cf134b3ac10ddee
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Server: nginx
Access-Control-Allow-Origin: *
P3p: CP="NID DSP ALL COR"
Location: https://udmserve.net/udm/fetch.pix?dt=1;admix=bcf905babaae460a9cf134b3ac10ddee
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=25
Content-Length: 0
X-Xss-Protection: 0

GET
H/1.1

200
OK

fetch.pix
udmserve.net/udm/
Redirect Chain

https://cs.admanmedia.com/sync/underdog?redir=https%3A%2F%2Fudmserve.net%2Fudm%2Ffetch.pix%3Fdt%3D1%3Bacu%3D%7B%24UID%7D
https://udmserve.net/udm/fetch.pix?dt=1;acu=58c80c8e8be87fc5c8bba67a994ab49d9205f32e

43 B
614 B

369ms
155ms

Image
image/gif

68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udmserve.net/udm/fetch.pix?dt=1;acu=58c80c8e8be87fc5c8bba67a994ab49d9205f32e
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Cache-Control: max-age=43200
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://udmserve.net/udm/fetch.pix?dt=1;acu=58c80c8e8be87fc5c8bba67a994ab49d9205f32e
Date: Tue, 17 Aug 2021 17:57:47 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 30EE 86 KB
30 KB 511ms
506ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6aecf13b88a3ab22399f1ca5d6582e89c6360b677febea6f0b9b9abf2dfb7d52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 31032
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C979 22 KB
9 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: http://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Host: tpc.googlesyndication.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://zaytung.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Content-Length: 8395
Date: Tue, 17 Aug 2021 12:48:45 GMT
Expires: Wed, 17 Aug 2022 12:48:45 GMT
Last-Modified: Tue, 03 Mar 2020 20:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Cache-Control: public, max-age=31536000
Age: 18542

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame 335B 0
0 93ms
54ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst8jfFkHc9pcIPOOO-zkbNhFEigHX1va0himnGAWEBBARmzI-5F9KfsZ7FgbzyIUfGBnyMRMY_SA7l2BOH7UwHolCDbSUdDDXhiAVvDZ0KYFrdy7BepAOtCzHbM6Kgdbu9aK-KGm_voKpNBoylvZOgMDLQ120Ja2pVFfStoA0O7vm8MTB5erETbUba5TQmK9lt7gPM315cE_-R-1FQvcxjQ2jONoBC57LWaOeDgYmcYnn4Mnmb3iRWh_E9ABCfeARDLheKUL-_sjqPMhR0nu9dwqdP3akXwvNYCQOh9dXqVmg5Nw9p48A&sig=Cg0ArKJSzAqDQk84CL_4EAE&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
DATA 200
OK truncated
/ Frame 335B 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c096ce68c8fba8c382e3ec5b8ca7ff347a12fd897ce77a56a5665f53783dd4bb

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 gemius.js Show response
gdetr.hit.gemius.pl/ Frame 104D 39 KB
11 KB 37ms
36ms Script
application/x-javascript 92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/gemius.js
Requested by: Host: gdetr.hit.gemius.pl
URL: https://gdetr.hit.gemius.pl/gdejs/xgde.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: 3a9e1241a0f339036914dcf96b8892341f69237f1184833809a9637e4e0fc24a

Request headers

Referer: https://gdetr.hit.gemius.pl/gdejs/xgde.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
last-modified: Wed, 11 Aug 2021 15:23:22 GMT
server: GHC
vary: Accept-Encoding,Origin
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: max-age=43200
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 10761
expires: Wed, 18 Aug 2021 05:57:47 GMT

GET
H/1.1 200
OK rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ 124 KB
38 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Content-Encoding: gzip
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
Server: sffe
ETag: "1629113426487594"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=3000
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Length: 38194
X-XSS-Protection: 0
Expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
H3-29 200 320x100.html Show response
s0.2mdn.net/10978836/1625049614695/ Frame 68F1 6 KB
2 KB 22ms
8ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10978836/1625049614695/320x100.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0adcb9b5d30ca41659c2f071ea14ad341a2ff625852fd71ce3ba9529dad2620c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /10978836/1625049614695/320x100.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2333
date: Tue, 17 Aug 2021 00:36:50 GMT
expires: Wed, 18 Aug 2021 00:36:50 GMT
last-modified: Wed, 30 Jun 2021 10:40:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 62457
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ 0
545 B 130ms
63ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssqdMZyUHCxxb84Xqpw8OzDLCDy8g3K-J1Xd4OaUWkH_DwNBQ2qJuz0gB03gloLlZWcOMyul7-eurQ0an-S0Uj5V-A2l8vIoeaQtQujunWxgMv9BCMIlL8JV9dU3gbtMX_vVrTp4tHnV6tlYvKrFdj9&sig=Cg0ArKJSzMdrnaWUUukkEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=304&cbvp=1&cstd=300&cisv=r20210812.76676&adurl=

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
16ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=zaytung.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F791 84 KB
30 KB 406ms
406ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4c5f433afb25fed25ded85b1f5b493d0fa7bb28053fbfd0a8bbfe6f661c5344d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 17 Aug 2021 17:57:47 GMT
server: cafe
content-length: 30468
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A0F5 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9569288f2b0d4052d3e6e08a132065281a913b68a6e658c912793e3c8d4b1e0c

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame EA98 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame EA98 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EA98 124 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:47 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame EA98 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 8D4B 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8245
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 49 KB
14 KB 10ms
9ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d0e4b36498928026e593b3e5fb37f307c097963e5ba13b576f703051d035c97

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/10023993934787577230/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 16 Aug 2021 21:33:47 GMT
expires: Tue, 16 Aug 2022 21:33:47 GMT
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 14324
age: 73440
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame EA98 0
0 33ms
33ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ci9xvmvgbYY_9Ko6ElgSAkKDoDZG-7Jte_Z66zYQKtt3AhIYCEAEg9ZS4FWCVAqABh-ir9ALIAQmpAstjZ5QuqLM-qAMByANIqgT_AU_QJgbuUaJj2SpMljG1QxADXfNOoKw6toGiMp16ykKPgeF1dX9qFYXSuBIxBzEE-YMXKWyLzFn60LwQqIQvYhvH2Rfym4h8qTd1qzaew9ELkDBohvN9gDGjBA_dTYygVFt99-a92xc3mxC6p_hG_MrtKruqzSzEaZ0mHbVr335W-6yjS65b8s2hZFqID0vKv68BVefxwlzQ48odghHW2o30AqzVE4eN-JN7eQJUz2Mk_k_F_qBiaXWNBDyriBz1azpA-BbNsvhltSODVYEno1QQPCpbcMgFC4AG0mxZdEde9sXoHaJ8zqWISOAvCBBxZ7fe2r17Nhh6qtf7lbHECcAEkP2auaQCkgUECAQYAZIFBAgFGASgBi6AB-CW04sBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEIv8B9IICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXHAoaCAASFHB1Yi00Mjg1NTYxMDg3NTc0MDI0GAA&sigh=VB82pmRqvr8&template_id=419

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2

200

rules-p-effSsmMYCbAck.js Show response
rules.quantcount.com/
Redirect Chain

http://rules.quantcount.com/rules-p-effSsmMYCbAck.js
https://rules.quantcount.com/rules-p-effSsmMYCbAck.js

3 B
428 B

43ms
11ms

Script
application/javascript

2600:9000:2104:5400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-effSsmMYCbAck.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:5400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 21:01:57 GMT
via: 1.1 7f71f5258c6bbee046a26011fbbfa997.cloudfront.net (CloudFront)
age: 75351
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 21:04:20 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
x-amz-cf-id: 0-9I9jPlGG_d6wSRAofoJ3ysDo-EsZvrLOH7AYWypGy-xAru6Sw3Kw==

Redirect headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Via: 1.1 e13e8f228afcbd0862f27c6ebd714879.cloudfront.net (CloudFront)
Server: CloudFront
X-Amz-Cf-Pop: AMS1-C1
X-Cache: Redirect from cloudfront
Content-Type: text/html
Location: https://rules.quantcount.com/rules-p-effSsmMYCbAck.js
Connection: keep-alive
Content-Length: 183
X-Amz-Cf-Id: uu85RrI2rCq9z-CRoQxksUObDJjGel_rvoDZ4NOsiFnpJgEgnaA_bA==

GET
H2

200

rules-p-Pz67dCqdsHfxh.js Show response
rules.quantcount.com/
Redirect Chain

http://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js
https://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js

147 B
602 B

44ms
13ms

Script
application/javascript

2600:9000:2104:5400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:5400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 57b7f2b2bcdd983268775ebc6ee71d208510b285d79dd058f2717248079c59d1

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:10:48 GMT
via: 1.1 7f71f5258c6bbee046a26011fbbfa997.cloudfront.net (CloudFront)
age: 2820
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 147
last-modified: Tue, 27 Apr 2021 19:10:31 GMT
server: AmazonS3
etag: "f7c84b69d3abe411fbfc06992543fbe2"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
x-amz-cf-id: FSYLPKAd2Z8ySg_BZ2B0oBGEhWYsLZFg4v9-hUPsUn6WknfMScGZ2w==

Redirect headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Via: 1.1 084f866feba2345e668d9a32662696cf.cloudfront.net (CloudFront)
Server: CloudFront
X-Amz-Cf-Pop: AMS1-C1
X-Cache: Redirect from cloudfront
Content-Type: text/html
Location: https://rules.quantcount.com/rules-p-Pz67dCqdsHfxh.js
Connection: keep-alive
Content-Length: 183
X-Amz-Cf-Id: BDEIZ5D7DbUAmZ1idhrVxcxATarEG6gH3vxS00143yYnSZvUKEEEOw==

GET
H2 200 json Show response
trc.taboola.com/zaytung/trc/3/ 11 KB
5 KB 115ms
109ms XHR
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/zaytung/trc/3/json?tim=19%3A57%3A47.687&lti=deflated&data=%7B%22id%22%3A438%2C%22ii%22%3A%22%2Ffotohaberdetay.asp%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1629213006226%2C%22vi%22%3A1629223067685%2C%22cv%22%3A%2220210817-13-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A12045%2C%22qs%22%3A%22%3Fnewsid%3D395636%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A3%2C%22uim%22%3A%22thumbnails-il%3Aabp%3D0%22%2C%22uip%22%3A%22Inline%20Thumbnails%22%2C%22orig_uip%22%3A%22Inline%20Thumbnails%22%2C%22cd%22%3A1593.0625%2C%22mw%22%3A630%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: dd132d8c17edde5b20077eba3b92f59e3cde111610230293cb4601725d8de62e

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

x-vcl-time-ms: 81
date: Tue, 17 Aug 2021 17:57:47 GMT
content-encoding: gzip
server: nginx
x-timer: S1629223068.703966,VS0,VE81
x-served-by: cache-fra19148-FRA
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: http://zaytung.com
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H3-29 200 page.php Show response
www.facebook.com/v2.2/plugins/ Frame 0009 62 KB
19 KB 72ms
70ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5c1a14b2872697711a2f9158f1f14f68b51ba9496acac58c9fce2dfaecd60159

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
facebook-api-version: v4.0
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: 47lx6+y8yFyypWiCzkzaiPqS364/IQ1eZEJ6Wyn/aPDTwq/38B7rjvLh3rE3EPmEGJEU44ATJwnUmOLcdgV4aQ==
date: Tue, 17 Aug 2021 17:57:47 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29 200 like.php Show response
www.facebook.com/v2.2/plugins/ Frame 1AC6 0
21 B 35ms
34ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df13c15e3bac836%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=604&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df13c15e3bac836%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=604&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: WMdAwBBKhKW7Bhb1EtYos7gukFXt8vVJaY+do0WbEZu705mWVXDffTVuGD5qrFgjmoUPxxp2M40tydbE/6DjvQ==
content-length: 0
date: Tue, 17 Aug 2021 17:57:47 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29 200 comments.php
www.facebook.com/v2.2/plugins/ Frame 85F3 0
0 30ms
30ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfc389fd46ab38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=93&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfc389fd46ab38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=93&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: Zke3LrWKiAyCw1wCOUWprB7TsNcvCg7Ekjc+qKN0kyL6vcmocRxWJIcP5WIkuC5NyfpvgnTHnVR0AV39DgmKJw==
content-length: 0
date: Tue, 17 Aug 2021 17:57:47 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H/1.1 200
OK widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html Show response
platform.twitter.com/widgets/ Frame B4E5 319 KB
103 KB 7ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=http%3A%2F%2Fzaytung.com
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6711) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://zaytung.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 701967
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Aug 2021 17:57:47 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Mon, 02 Aug 2021 20:33:53 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6711)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H3-29 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/ 96 KB
33 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/cb=gapi.loaded_1?le=ili,ipu

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc82df2f8041f07089f9f1de17bde75873054929b9b291768798401c210a7cd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1909
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34128
x-xss-protection: 0
last-modified: Wed, 07 Jul 2021 13:43:54 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 17:25:58 GMT

GET
H3-29 404 fastbutton Show response
apis.google.com/u/0/se/0/_/+1/ Frame 936F 2 KB
2 KB 19ms
7ms Document
text/html 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&origin=http%3A%2F%2Fzaytung.com&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__
Requested by: Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: ac15d1868a55adcea61641c78efbb86feda3a65882f21bfe9fedd7348fb54be8

Request headers

:method: GET
:authority: apis.google.com
:scheme: https
:path: /u/0/se/0/_/+1/fastbutton?usegapi=1&origin=http%3A%2F%2Fzaytung.com&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=221=VAeYUzzh2MU25j0Qe4WWSZrIPmGYa_n2Sl8MgQeVVRfo8gdpB4saBBI2qCaK_Aa9scqfBI6wnwrBBzeTAVpr8ZI7C3I9RpaP0ObDvAPyuvo3M2j-uCP4_a9W-RAQrlTNodi664lb64E3QaXKkUw3bjECN7WVtnJEV79JMQfhMNc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html; charset=UTF-8
referrer-policy: no-referrer
content-length: 1585
date: Tue, 17 Aug 2021 17:57:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 7expTFhmPeK.css
www.facebook.com/rsrc.php/v3/y-/l/1,cross/ Frame 0F39 18 KB
5 KB 13ms
7ms Stylesheet
text/css 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/y-/l/1,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

91c617ff9074d05a5d2da254a5e88b2e74dc1f749a731f134eb5a6ac984928ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FZaytung%2F214922486305&width=292&colorscheme=light&show_faces=true&stream=true&header=false&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 18:53:27 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: gQeYWA2wo/CqxUdpELD8eA==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob:;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
content-length: 4754
x-fb-rlafr: 0
x-fb-debug: SXoiAGKTF4g63Z6ZifmLWOxSb+BNTX/2B/jEkwONd3taWxCTdo4h07N5tQ/EcIKjPch5/zJxjmPXqbS9xCW6Jg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 16 Aug 2022 18:53:27 GMT

GET
H/1.1 200
OK bcv1.js Show response
bid.underdog.media/ 9 KB
4 KB 33ms
22ms Script
application/x-javascript 2600:9000:2104:7e00:5:c4ab:c3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://bid.underdog.media/bcv1.js
Requested by: Host: bid.underdog.media
URL: http://bid.underdog.media/udm-r3_v2.7.10.js
Protocol: HTTP/1.1
Server: 2600:9000:2104:7e00:5:c4ab:c3c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5b441eeb9b4277ce032cd2b07234e71a146a16a645d30db1028c9073f57216d4

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:54:10 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 17 Aug 2021 17:30:04 GMT
Server: AmazonS3
Age: 218
ETag: "756ade2b04145f23b16dfb48878546cb"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 362b298821815168614ba932732916eb.cloudfront.net (CloudFront)
Cache-Control: max-age=1800
X-Amz-Cf-Pop: AMS1-C1
Accept-Ranges: bytes
Content-Length: 3679
X-Amz-Cf-Id: zDfVC3DCVlxbtiRcq717XaJ_RZARAOfN2sRl9wh4WY6gPAIXlhpIbQ==

GET
H/1.1 200
OK img.fetch Show response
udmserve.net/udm/ 1 B
470 B 162ms
162ms Script
application/x-javascript 68.71.249.118
ZEROLAG

General

Check archive.org

Show headers Download Go to

Full URL: https://udmserve.net/udm/img.fetch?sid=14256;tid=1;dt=6;gdprApplies=true;consentGiven=false;consentData=cmpMissing
Requested by: Host: bid.underdog.media
URL: http://bid.underdog.media/udm-r3_v2.7.10.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 68.71.249.118 , United States, ASN20093 (ZEROLAG, US),
Reverse DNS
Software: /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:47 GMT
Connection: Keep-Alive
P3p: NOI DSP CURa ADMa DEVa PSAa PSDa OUR IND UNI COM NAV INT
Content-Length: 1
Content-Type: application/x-javascript

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6EA6 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=8578382730&adk=921463585&adf=648468548&pi=t.ma~as.8578382730&w=970&lmt=1629223066&psa=0&format=970x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066559&bpp=1&bdt=615&idt=109&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=312&ady=226&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=13&uci=a!d&fsb=1&xpc=wqVjuG7LmC&p=http%3A//zaytung.com&dtd=126

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:42:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 890
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame EA98 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf2051b1ff1ecdbd06b810288a1ded0bb6eac62c2752b0b5730e1f87522d8f50

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 tfa-eid.20210817-13-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 14 KB
5 KB 31ms
29ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/tfa-eid.20210817-13-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/zaytung/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 80c51846e84e9218f4e11b80e3427ac33539ca65f2f66d910e059df4e23478e2

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: rOLQKDH3nBnZwumNo9xtowK5Syskw.BY
content-encoding: gzip
etag: "e2c3b03bd59871b8bf9691b2b4e214f7"
age: 10617
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 5063
x-amz-id-2: f7IJbpKG1L1dXABW5n5bobTGLiMmitgzlI3HeaM2HZW2ut8HJzu9aGmpItaWt6Z4PS9sP6hV/Bs=
x-served-by: cache-fra19148-FRA
last-modified: Tue, 17 Aug 2021 15:00:46 GMT
server: AmazonS3
x-timer: S1629223068.029920,VS0,VE0
date: Tue, 17 Aug 2021 17:57:48 GMT
vary: Accept-Encoding
x-amz-request-id: T8TDTQBDXV9ZJF68
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 57
x-cache-hits: 42664

GET
H2 200 sha256.20210817-13-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 6 KB
3 KB 30ms
30ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/sha256.20210817-13-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/zaytung/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 910170debb8f5e390ed569fa098a4ffba9fef9b36c9b1c38a76aadc179f903b3

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 4zFZ449rd57OFTtDIC04trcdtI8rHG2x
content-encoding: gzip
etag: "b0f4b0f898417433b1433947780cec16"
age: 10606
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 2590
x-amz-id-2: 86QmwYGxvtyGVldWy0ParspBWH1fnKcWxslQ/hGjTIlNfHl0Gz4DPaN0UtPB6t7RXajV4VR3SAA=
x-served-by: cache-fra19148-FRA
last-modified: Tue, 17 Aug 2021 15:00:59 GMT
server: AmazonS3
x-timer: S1629223068.030039,VS0,VE0
date: Tue, 17 Aug 2021 17:57:48 GMT
vary: Accept-Encoding
x-amz-request-id: SNDPM4M2E0B48JZE
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 57
x-cache-hits: 41064

GET
H/1.1 200
OK c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
cdn.taboola.com/static/c5/ 3 KB
2 KB 56ms
33ms Image
image/svg+xml 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/static/c5/c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 3GoWmPpnzFDs5CP3.ebHbCmhALWQMuvH
Content-Encoding: gzip
ETag: "11d8569a7da0739259e3ac0b0d666e94"
Age: 63
Via: 1.1 varnish
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 1502
x-amz-id-2: dG5btsDeY+PXEquROAVOM4aSIiDscRq1Gl9IHePBB8GJnqlJNRRfiUhPAFZjTJrdG2p1UE93Z4g=
X-Served-By: cache-fra19161-FRA
Last-Modified: Sun, 10 Jun 2018 13:23:55 GMT
Server: AmazonS3
X-Timer: S1629223068.077637,VS0,VE0
Date: Tue, 17 Aug 2021 17:57:48 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
x-amz-request-id: F5F03R83Q1CDSQFG
Access-Control-Allow-Origin: *
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
Content-Type: image/svg+xml
Access-Control-Allow-Headers: *
abp: 57
X-Cache-Hits: 43

GET
H/1.1 200
OK tb Show response
15.taboola.com/ 31 KB
9 KB 108ms
87ms XHR
text/html 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://15.taboola.com/tb?oid=15&pubnm=zaytung&unitType=226&tbloc=&pageType=text&pstn=Inline%20Thumbnails&uuip=&cisrf=&cirf=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&encoded=1&uid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&variant=-100|1&callback=TRC.videoTagCallbacks.videoCallback1&cb=1629223068066&tagid=&cntry=FR&platform=1&sesid=0c40e1f5259f0e96c98b3f789c4d6347&itemid=/fotohaberdetay.asp&viewid=1629223067685&geolat=&geoing=&deviceifa=&appid=&sd=v2_0c40e1f5259f0e96c98b3f789c4d6347_9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b_1629223067_1629223067_CNawjgYQu61GGKXAjKq1LyABKAEwSjjE1whA94sQSLiF2ANQlqEPWABgAGixr-m1yv33zq0BcAA&ri=eb912b8d0115b0375c7155b773104c62&appname=&cdb=&gdprApplies=true&rid=&sii=1619123555380413571&oee=true&tpubid=1152699&uis=2&fagg=1&ccpaDns=false&ccpaPrivacy=&region=PAC&hasGDPRConsent=true&tcfVersion=&cmpStatus=&tnetid=&prcnt=&layer=
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a5606368e59827b69f57c63e2ea5ae0d1e4dd612da48a4a9ea4a138971786f48

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: http://zaytung.com
MachineId: 1449
Transfer-Encoding: chunked
X-Cache: MISS
xvid-debug: mrmr - :
Connection: keep-alive
X-Served-By: cache-fra19149-FRA
Pragma: no-cache
Server: nginx
X-Timer: S1629223068.107038,VS0,VE49
Vary: Accept-Encoding
Content-Type: text/html;charset=ISO-8859-1
Via: 1.1 varnish
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Link: <http://am-wf.taboola.com>; rel=preconnect
X-Cache-Hits: 0

GET
H2 200 userx.20210817-13-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 17 KB
5 KB 30ms
30ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20210817-13-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/zaytung/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e01f922b19c72897e36e730270a7f1a506fa3976dc5ad6cc3b239a5443e806c1

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 2SByTy0ptQlQDCGEcRNVCZY5qmqQFM4m
content-encoding: gzip
etag: "7b72cb23c89788f6cbbaf54dc383a344"
age: 10623
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 5342
x-amz-id-2: i6CqKaKhTXs2UuarzkLL00/EjgwDntMieW8PIU+D5Ff6wDO5wW6QBAefoPBM+PNzYV4RNFTlDM8=
x-served-by: cache-fra19148-FRA
last-modified: Tue, 17 Aug 2021 15:00:42 GMT
server: AmazonS3
x-timer: S1629223068.078317,VS0,VE0
date: Tue, 17 Aug 2021 17:57:48 GMT
vary: Accept-Encoding
x-amz-request-id: TR4S2V3MXMV6NVF9
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 57
x-cache-hits: 8581

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame A0F5 0
0 53ms
52ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss8pj_Sjvu3OkBSD9MA6ltg0iSbe4tZE7vIsy9pKhtBf_POxggojdkQyBRuioSv5D2yMiJVCIwE3OIahMoTKM-0ifbAGoDP0xhBXwlJ8t40VoOhm9FhfMiYCagciqYJQhSAZ6nzHHm6JByTF2tfbmHI-jC60iUGxu9ls9iN1qUBEODu2Cy0jtBkHo7wYuzRuZui9_8ohzlDxqQsMawqb4Ysrdmh7iShKNkC47dtCDQqKiKHsJA94DhmfS0rLXrXcnKYGistjliE5J9eQJhc6Df9JQuPj48XccSn6MaU6zR7tkLcCdQT&sig=Cg0ArKJSzGhKrw6FkBMqEAE&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 17 Aug 2021 17:57:48 GMT

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame EA98 0
20 B 41ms
41ms Other
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI-ymvHQuPICFQ6ChQodAAgI3Q&gqi=mvgbYe2pKq60nsEPnMO6oAQ&layout=/sadbundle/%24csp%253Der3%24/10023993934787577230/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

redot.js Show response
gdetr.hit.gemius.pl/__/_1629223068091/
Redirect Chain

https://gdetr.hit.gemius.pl/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D...
https://gdetr.hit.gemius.pl/__/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq...

2 B
177 B

40ms
39ms

XHR
application/x-javascript

92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/__/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
access-control-allow-origin: http://zaytung.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 2
expires: Mon, 16 Aug 2021 17:57:48 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
server: GHC
access-control-allow-origin: http://zaytung.com
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1629223068091/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/fastid=fyqekuwgvcnxfsgrancfldfweplg/stparam=ojqsojqozm&extra=ls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 16 Aug 2021 17:57:48 GMT

GET
H3-29 200 createjs.min.js Show response
s0.2mdn.net/10978836/1625049614695/libs/ Frame 68F1 236 KB
62 KB 14ms
8ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10978836/1625049614695/libs/createjs.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10978836/1625049614695/320x100.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

adf379f80ce276b9dc4030667cf06a2b68c7bc10908a9cc4d492b8b96aa15997

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10978836/1625049614695/320x100.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 04:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47544
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63921
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 10:40:14 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 18 Aug 2021 04:45:24 GMT

GET
H3-29 200 320x100.js Show response
s0.2mdn.net/10978836/1625049614695/ Frame 68F1 54 KB
14 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10978836/1625049614695/320x100.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10978836/1625049614695/320x100.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

688cfdff6487eec489878650058b24113a65fbd5ee736385a1ce170f16903abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10978836/1625049614695/320x100.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 04:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47544
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14577
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 10:40:14 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 18 Aug 2021 04:45:24 GMT

GET
H2

200

/ Show response
adx.adform.net/adx/ Frame A0F5
Redirect Chain

https://adx.adform.net/adx/?rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286
https://adx.adform.net/adx/?CC=1&rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286

620 B
1 KB

58ms
46ms

Script
text/javascript

37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?CC=1&rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f43807737b5f34b41aa74f0fd9ecf91b69fef778bef1653e32bb36cec1d38347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 666
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
server: nginx
location: https://adx.adform.net/adx/?CC=1&rp=3&pv=1&bWlkPTM1NDMwMQ&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&callback=_adform_cb_1629223068108_6257548716607286
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: text/html; charset=utf-8
expires: -1

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CAA 42 B
63 B 42ms
38ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BkP6X9qTewdVo9dGWJVnkCjGlkbYbjTegHSb9TiCRe5kOeg4e-fjT0P0WUcrLS60-FhFd_0BWtBZ2c7CfQmSNo5Cr32ok9ppwBoi1Rbyh4F1oBmXM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 1CAA 2 KB
1 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 1CAA 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1CAA 124 KB
37 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4696 624 B
297 B 21ms
19ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:57:48 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 1CAA 18 KB
7 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:26:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:26:30 GMT

GET
H3-29 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame 1CAA 6 KB
3 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9dff9c5d8bb8ff3117fe17757c275af96ca695dc60d7fb811331cb38815a91a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:17:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2439
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2627
x-xss-protection: 0
server: cafe
etag: 17449454297928180344
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:17:09 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1CAA 0
24 B 110ms
74ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssHhlnr9Z-IK25VYrrIa3OefKmaKfxn3QBt9_2xDHPcFYTrepDYqIG_JWlukcfcULicGTFCu7dvjPvjjDWKBnDskBrvV0Ed3pQr96niaxSVHOk3lyaVeGA_XPNTkV-SNL9IYqQBP45xC_nVCy5uVAO_XN3P3ZRfJFCLuzIzKeItZaiYUfOZHr2Co9JvaYUSE8cthwyxo0tc8nSvhMACZSQXIbuczC4UX0XP9pNuKxBzX2lt5shKcY0Q9sd_bK9X5n6QPVA_ktL7NkreMUEYhf2W8nQ_L0NNRyzsH0kFKXT3PkxfA_3Q2HDxYUokDhamw_Nf2FZ2rF6Xq8WP021MpJAA4RHRDoBQC9luBoJpkACsXSsFVO1hzjSpnmTZNSP6aYyo5nVU0mAqSvvmA7QM0OMLubrc9Ahu1hgQNEXnBdELto15JwRwyxz5B8EtozWlqNPatp6n53RU9nz2ek33aDUb2_OPabftbcLJ2LIUOOOnLYICCCpybqZd9S2GLnRD3EylvZwuodDFuKDZGny_Ss-xIoDYxk85pBCGMWdrQ-iv5UzjSTHgt4PxXR6kT2IQCH1Bb0VcK4SDFAvhrGbATZcltuz3sd0cmRQSayW8xTPIebfBt_JhvINzZqFZy3raDNESh1SMN_1DKrP4EdbQwBtRPjeNUPDMORJwM628ShnvLzAQ6-VrbfiXm6ke7GSD9r1NgQhoABuGp5netByferSFoSPJIL6B6lljE1pH0L8xyLpFl5D02T-n25UssqH4hXXePXPCWmnsm5ctcuaVujNnB3UsBU12clemt1qfeNInh7FvLaxt7f9znvX4WtzxqB_sNawzd-4w6qbp69GcYggvgQVeSSFzNiRGbdQt-rR0NdZHMFs-GFiZtZdIR2IyRcnmWIhVjcdL7UdWNCwaIJoc9yZqr8VXvdjZ1F7mpfrFXiSAcHoY-PJuW5xftYAv-pyNC2fWOAZovAltH8Yn7BkOo11C7m1lcQmZbLIMbpGcXo3I0qQbV93piGZ_-rBDv20G13uqGcAun0GQUth8SRh5hkq61EIBhiDl-PoH2FcUhEyjNinXE6Chs2pqMXULZaG3TXuFOZGvlvbg26aC_vKofn3IPeDiCA1eRPwO2MDeFMtHZPK0KuJeP_5pHuZrkxMWBVd0Du7QiLNzgoxnka-juWqqqeVV6QYIVV6v8exhEdqkydQ4d-WB1yhUCiDZFoEwa4EPNsGbIXFk&sai=AMfl-YQuPVBNUXEyA3Z3CgDGHVAWZ5ZFoCNVqV2Lv1Id1SG9iBoEx0kZmYln0R4ALENjdLaXBAwUXcK8LzKpRJJNVwuGsQgaucaxWRU7O_dZ_1F2BtAOyWstwY5TKnCCa33ALjy09DtPnzrRzLgLzC47_fGRK07gPhu1fhh15aPy_BIqFY2B5s0jVOLGgKYTMEydoQIzvMybokMIuG44SAY-pBJdgJlRG8aKTnHyYNYFq0SVjUZ9UBNt5IdMP7GH4j13rrTrngGBUcBNM8a6POFDtzRZOASadqU&sig=Cg0ArKJSzHvQD4sUAlvXEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210812.93193&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1CAA 41 KB
15 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 09:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31556
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 09:11:52 GMT

GET
H3-29 200 15879852203169948034
s0.2mdn.net/simgad/ Frame 1CAA 12 KB
12 KB 10ms
8ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15879852203169948034

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f2e7ef3e0abf02f1a7b8fbdc60cffcdfb206668531e5a7dc6d3fe6b8436ef45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 19:44:47 GMT
x-content-type-options: nosniff
age: 598381
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12652
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 14:15:53 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 19:44:47 GMT

GET
H2 200 2ea6a324-6abd-468a-8b88-200dee9615b3.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//iaevm.com/content/ 4 KB
5 KB 53ms
40ms Image
image/webp 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//iaevm.com/content/2ea6a324-6abd-468a-8b88-200dee9615b3.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: cb0d0ac46d2fe398d02a05a65cdcdfb95797f940a900e08968a70bd8b6f5ef8e

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 varnish, 1.1 varnish
age: 3144536
edge-cache-tag: 341847873993580082754293057496904908928,534554604223319601008643105194670925976,29ecf9b93bbf306179626feeda1fab70
x-ratelimit-remaining: 100
x-envoy-upstream-service-time: 55
expiration: expiry-date="Wed, 14 Jul 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//iaevm.com/content/2ea6a324-6abd-468a-8b88-200dee9615b3.jpg
content-length: 4376
x-backend-name: CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
last-modified: Sun, 13 Jun 2021 03:28:09 GMT
server: nginx
x-timer: S1629223068.169103,VS0,VE1
etag: "a484ccb99966f459e888dc47bbf5f383"
x-served-by: cache-wdc5530-WDC, cache-dca17739-DCA, cache-fra19148-FRA
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 1

GET
H2 200 e87deb77-2add-4f7c-8a5c-717125dd97f5.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//kjocy.com/content/ 15 KB
16 KB 54ms
41ms Image
image/webp 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//kjocy.com/content/e87deb77-2add-4f7c-8a5c-717125dd97f5.jpeg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9adc529d888b662dc68f832e4a2476ca782af86e3314643edb34a3b35f2125de

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 2
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 varnish, 1.1 varnish
age: 5441681
edge-cache-tag: 460160138994695753165071717798813243334,534554604223319601008643105194670925976,29ecf9b93bbf306179626feeda1fab70
status: 200 OK
x-ratelimit-remaining: 98
x-envoy-upstream-service-time: 41
x-cache: HIT, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//kjocy.com/content/e87deb77-2add-4f7c-8a5c-717125dd97f5.jpeg
content-length: 15284
x-request-id: 34cb8a4d1ad448db375a63fda5bb30e7
x-backend-name: CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
last-modified: Tue, 15 Jun 2021 10:28:03 GMT
server: nginx
x-timer: S1629223068.169106,VS0,VE2
etag: "5fcdebfbe1b97fb48bce86a2390c75ab"
x-served-by: cache-wdc5558-WDC, cache-dca17738-DCA, cache-fra19148-FRA
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 5

GET
H/1.1 200
OK tbp Show response
15.taboola.com/ 6 KB
3 KB 94ms
69ms XHR
text/html 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://15.taboola.com/tbp?oid=15&pubid=166277&tagid=948107&pstn=[pstn]&cb=[cb]&callback=TRC.pVideoCallbacks.videoCallback1
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: fd1788630511783f0b4c56d7a45e8daf1dc48176082cddfcd5016836f66a4746

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: http://zaytung.com
MachineId: 1418
Transfer-Encoding: chunked
X-Cache: MISS
Connection: keep-alive
X-Served-By: cache-fra19155-FRA
Pragma: no-cache
Server: nginx
X-Timer: S1629223068.187842,VS0,VE30
Vary: Accept-Encoding
Content-Type: text/html;charset=ISO-8859-1
Via: 1.1 varnish
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H2 200 28b156bab555033082163cf7b4cde551.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 16 KB
17 KB 50ms
39ms Image
image/webp 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/28b156bab555033082163cf7b4cde551.jpg
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a9406bbb0c5e2d17f41989e3705be66ede7d32888b1fa8088cc04bfed9c863f9

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 varnish, 1.1 varnish
age: 2161962
edge-cache-tag: 603530666801434461102329912107512467870,534554604223319601008643105194670925976,29ecf9b93bbf306179626feeda1fab70
x-ratelimit-remaining: 100
x-envoy-upstream-service-time: 62
expiration: expiry-date="Sun, 25 Jul 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: HIT, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_217%2Cw_260%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/28b156bab555033082163cf7b4cde551.jpg
content-length: 16598
x-backend-name: CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
last-modified: Thu, 24 Jun 2021 05:46:44 GMT
server: nginx
x-timer: S1629223068.169076,VS0,VE1
etag: "8a3c7277ca6e6ade3b609109f8cb83dc"
x-served-by: cache-wdc5557-WDC, cache-dca17774-DCA, cache-fra19148-FRA
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 1

GET
H2 200 postmessageRelay Show response
accounts.google.com/o/oauth2/ Frame BE7E 566 B
568 B 18ms
17ms Document
text/html 2a00:1450:4001:831::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fzaytung.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/cb=gapi.loaded_1?le=ili,ipu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

65caa8bf4b963d8313cd2176ecabf77a050ea56b2d81415a8a763ec1ab8fc647

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CcJt4dJv6yaGWozKp8MrNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=http%3A%2F%2Fzaytung.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=221=VAeYUzzh2MU25j0Qe4WWSZrIPmGYa_n2Sl8MgQeVVRfo8gdpB4saBBI2qCaK_Aa9scqfBI6wnwrBBzeTAVpr8ZI7C3I9RpaP0ObDvAPyuvo3M2j-uCP4_a9W-RAQrlTNodi664lb64E3QaXKkUw3bjECN7WVtnJEV79JMQfhMNc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 17 Aug 2021 17:57:48 GMT
content-security-policy: script-src 'report-sample' 'nonce-CcJt4dJv6yaGWozKp8MrNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK UnitWidgetItemDesktop.min.js Show response
vidstat.taboola.com/lite-unit/3.5.0/ 97 KB
28 KB 68ms
39ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3646f70c890c1423eb7ac39ff74feae35a3c2608a9d761c1b2cf81832e386a96

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Via: 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront), 1.1 varnish
Age: 896051
X-Cache: Hit from cloudfront, HIT
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 28158
X-Served-By: cache-fra19138-FRA
Last-Modified: Sat, 07 Aug 2021 09:02:26 GMT
Server: AmazonS3
X-Timer: S1629223068.318789,VS0,VE0
ETag: "94b213ae7b707514c001eb90b0c35705"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: bcfRUnW6LwK9nFLc_ZLiMvc3MR_iynCG1lW4E-DyV7Tn208l9lCSdQ==
X-Cache-Hits: 62973

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 060A 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssHervUOc98jatfMiNCpzyAGcdK9wVbNReWiV8DFo1QF62AohujQk6pPhPdhZD1cFzoNH_SBjfaHKlgkJiz7Z12wxkhV5veKSkO-TWhG76t8ON3_Z1WEk9-EGEvGA&sai=AMfl-YSfg5iHtOhi7r-HgAHibflypphnCsVvbjvrm1kg4gcFxe15hX62raQH3g8l7F1HYgrCM3k-zO4GX71yL0E-ikG9B6Ay-wj_TTc&sig=Cg0ArKJSzFmQhLYJmD9SEAE&cid=CAASF-RocwBSadmus-Dj1asAXEhnWOF16Dga&id=lidar2&mcvt=1121&p=80,148,680,308&mtos=1121,1121,1121,1121,1121&tos=1121,0,0,0,0&v=20210816&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=3920710080&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&eosm=0&rst=1629223066664&dlt=399&rpt=480&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B77B 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 01:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 18 Aug 2021 01:12:52 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame B77B 26 KB
10 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 18:31:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84395
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 18:31:13 GMT

GET
H3-29 200 13627508852648344519
tpc.googlesyndication.com/simgad/ Frame 7F0B 60 KB
60 KB 17ms
11ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13627508852648344519?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm7babhsGqncw9dcS5Z3EeL8xb6DQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a02214990650642f638f37df33e7cb0d41350d1574191be70220a7943b14392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 16:04:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 04 Aug 2021 16:30:28 GMT
server: sffe
age: 438771
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60928
x-xss-protection: 0
expires: Fri, 12 Aug 2022 16:04:57 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 7F0B 18 KB
7 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 7F0B 2 KB
1 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 7F0B 14 KB
6 KB 19ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 7F0B 0
0 44ms
30ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTJIK3nc9iYswAwM_KaKNcvu-lfIeFdHt-_09oxOb_3jT3-WbRaQBUwEC_uJqXOuXC3XQ1lmR0dmDZezUeZULYEINkVlA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7F0B 124 KB
37 KB 48ms
36ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 7F0B 26 KB
11 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2964eaaa17b81ff911681e57089511c35c7ebbbb8cce98e8c64bad2de197149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:35:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10743
x-xss-protection: 0
server: cafe
etag: 8915488205478863544
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 15:35:19 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7F0B 0
0 48ms
36ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CrhPZm_gbYYjID8KH9fgPhLa-uA2Vt_jHZK7WsoSIDufjor3AARABIPWUuBVglQKgAZ_6j7wDyAECqQK9pi1Ry0ZjPqgDAcgDyQSqBPABT9AOc1NsPG_PCLsRYPebGYS1uoUe3sCRR3vAtLkIF2aLSbF3SBo5PAzhf_cOGjq_4i1h89khe3I-NZQbI6uJ2Ov9XmA6HLBwwrFQmnKvPivNIfVGpRJk7yT6GvctOVSKL7QkkbDRj8LmN0OOoyqLXjTXZPcZEF4rfRJP9nb3F0RkSKyav4TLBkmMTGo5AOmxy1T-ClHER8tKSViQmD-OOy_zCZO0s4RSqEVA7IgKQQaRcmMT8weXI6Fz6pDcp3-c8KuicN7aOyUzTZ9XwO3KnCTUsgO3BgQaXB7GnDYTUzSKiTXjDIBusV7iaKJgOlmvwASOpdv3zgOSBQQIBBgBkgUECAUYBKAGAoAH-ujfQqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBCHkhDSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGAFwGyFxwKGggAEhRwdWItNDI4NTU2MTA4NzU3NDAyNBgA&sigh=cUvhdrD0KS0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 13627508852648344519
tpc.googlesyndication.com/simgad/ Frame 667A 60 KB
60 KB 14ms
10ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13627508852648344519?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm7babhsGqncw9dcS5Z3EeL8xb6DQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a02214990650642f638f37df33e7cb0d41350d1574191be70220a7943b14392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 16:04:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 04 Aug 2021 16:30:28 GMT
server: sffe
age: 438771
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60928
x-xss-protection: 0
expires: Fri, 12 Aug 2022 16:04:57 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 667A 18 KB
7 KB 16ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 667A 2 KB
1 KB 14ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 667A 14 KB
6 KB 15ms
8ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 667A 124 KB
37 KB 41ms
33ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 667A 26 KB
11 KB 16ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2964eaaa17b81ff911681e57089511c35c7ebbbb8cce98e8c64bad2de197149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:35:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10743
x-xss-protection: 0
server: cafe
etag: 8915488205478863544
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 15:35:19 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 667A 0
0 42ms
32ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C3ZLlm_gbYcCqEdWllgTu252YCZW3-MdkrtayhIgO5-OivcABEAEg9ZS4FWCVAqABn_qPvAPIAQKpAr2mLVHLRmM-qAMByAPJBKoE8AFP0L6GOsXRXKIme8t_ZTvSjEh7VPOapMgvj9opuf_kyQbzlqdOXSftBxkciRaNwrLQhcV9_cTT524LguBbqm7BHxKm0L26csxLEEjH2U5gccVCWKCEDjzqst5ODZWCQjLFI3p6os1Ra_VOhgf3v3MTz-gU9wfjAqmhXuiZrFKwiuhBe7bZgYvyyayETbQlKcfbrHunaQzVEXKiQ0PannK6g_o_KqnMAjfFqZ6_aRNrT9hvMirrzZc-DuIryxnRlVXvl_BrQPuNfGkpKztMrjHKtR3vLI-kTqt9mdYE67klq_m-B7U9a4n5NZB98ZsQDSzABI6l2_fOA5IFBAgEGAGSBQQIBRgEoAYCgAf66N9CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEOK6D9IICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi00Mjg1NTYxMDg3NTc0MDI0GAA&sigh=kia-BUML3LQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK creative_js.js Show response
vidstat.taboola.com/vpaid/units/27_2_17/creatives/ 4 KB
3 KB 76ms
32ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/units/27_2_17/creatives/creative_js.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6258018e9f890f2383a09a2be6df7792affd977d856e7247ace8341f5b5487f0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Via: 1.1 8cdf0467c0468ddfe8e9873c6bb8304c.cloudfront.net (CloudFront), 1.1 varnish
Age: 1665278
x-amz-meta-mtime: 1580720676
X-Cache: Miss from cloudfront, HIT
x-amz-meta-ctime: 1580720957
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1904
X-Served-By: cache-fra19151-FRA
Last-Modified: Mon, 03 Feb 2020 09:09:18 GMT
Server: AmazonS3
X-Timer: S1629223068.364892,VS0,VE0
ETag: "d80eacb3ed43f93a2da80d76e65d19a8"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: fAeHO52Fy78UbxheIVGwTQpabLzTVzA-RHX2HcKYyUH5P0SAs1-vKA==
X-Cache-Hits: 158753

GET
H2

200

pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20...
pixel.quantserve.com/
Redirect Chain

http://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns...
https://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;n...

35 B
372 B

12ms
11ms

Image
image/gif

2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068317;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

Location: https://pixel.quantserve.com/pixel;r=1487795230;rf=0;a=p-Pz67dCqdsHfxh;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=1;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068317;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website
Date: Tue, 17 Aug 2021 17:57:48 GMT
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 0
Expires: Wed, 18 Aug 2021 17:57:48 GMT

GET
H2

200

pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce...
pixel.quantserve.com/
Redirect Chain

http://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-16292...
https://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629...

35 B
371 B

12ms
11ms

Image
image/gif

2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068326;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

Location: https://pixel.quantserve.com/pixel;r=7928596;labels=edge.1%2Csid.14256;rf=0;a=p-effSsmMYCbAck;url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636;uht=2;fpan=0;fpa=P0-1361180323-1629223068318;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=zaytung.com;je=0;sr=1600x1200x24;dst=1;et=1629223068326;tzo=-120;ogl=title.A%C4%9F%C4%B1r%20Ceza%20Mahkemesi%20Hakimi%3A%20%E2%80%9CYarg%C4%B1laman%C4%B1n%20selameti%20a%C3%A7%C4%B1s%C4%B1ndan%20san%C4%B1%C4%9F%C4%B1n%20rak%C4%B1%20masas%C4%B1%2Cdescription.%2Cimage.http%3A%2F%2Fwww%252Ezaytung%252Ecom%2Ffotos%2FD6E8AF21-42A2-4740-A4E1-7A3E7A9B9B0A%252Ejpeg%2Ctype.website
Date: Tue, 17 Aug 2021 17:57:48 GMT
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 0
Expires: Wed, 18 Aug 2021 17:57:48 GMT

GET
H2 200 7expTFhmPeK.css
static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/ Frame 0009 18 KB
5 KB 39ms
8ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

11f42ca857ce06541d88c7bb60a1d098fb97578ad43f919b1995e05b9f9f62a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: N1NdDz155En/AvJohkVraQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4757
x-fb-rlafr: 0
x-fb-debug: nMXNWDTX8v0onY3gZsdZcVq3KqppNnKeS9WLacPljzM8PktwU+0QZWpgh801WXaVUOt8/X/vn+rR3q5/xNZTNg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Tue, 16 Aug 2022 17:55:20 GMT

GET
H2 200 5Fsnp3irenq.css
static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/ Frame 0009 2 KB
1 KB 37ms
8ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/5Fsnp3irenq.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ec98f88129d5c3180c878d70ae27ffcdf7907737e4d2e82ec41b6f81fe1cd8ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: J9gtDCcpBAeYh1TcXJ9kqQ==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob:;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 816
x-fb-rlafr: 0
x-fb-debug: pC1FFKhmMkrA19EI4UWYczTZariSdW6kV3LB2T6O/KvqH8vOgypoajS/OFS0SalhsC1hzro9e+CJXac40319Vg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:16:17 GMT

GET
H2 200 J72p10TEgyp.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ Frame 0009 299 KB
81 KB 48ms
20ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a1cc391d239011cc8f279135cd083054a901bac123c53d2640a630f938b3cf88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: TU/3nWX5Xkg0DMA6F+ZmpA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 83021
x-fb-rlafr: 0
x-fb-debug: 5XEukMXYMnOm4wIYxFyi0LOehLBsUA9QgSMF98GLnr4F7blC5sUoVVVG+X9hUCNRmxGG/YT3O5P1l8bdIUOxbg==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 16 Aug 2022 21:21:10 GMT

GET
H2 200 n3M57Te-s_v.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yQ/r/ Frame 0009 6 KB
2 KB 37ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/n3M57Te-s_v.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3c50badce7cb97142e754e7c20a9012835a5b7ebec352d6b8cc63599b762b15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: e9cyV2oOQCHCcOTmXPNOuA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1816
x-fb-rlafr: 0
x-fb-debug: Vl9Ha8ocoQ4Q/x62p/GC3ej98eYOp2Wdo47vQaC0uio69w7p//bJEngZqQQW+I0U9L6J2AFdmKLKPWNPCZOxAw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 12 Aug 2022 04:31:34 GMT

GET
H2 200 WG-Y1Lnd0i4.js Show response
static.xx.fbcdn.net/rsrc.php/v3/ya/r/ Frame 0009 62 KB
19 KB 37ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/WG-Y1Lnd0i4.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e06a4b89626ecf28bff1ba772e85c78b9365e16a7a536e8904f6b5153e952532

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ho7GiWqLFKNKY7yKyRr4Lw==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 19481
x-fb-rlafr: 0
x-fb-debug: z9SbWro3mw7zJQ1z6dLpLSQHCxJ3bRGuIHgzCah/yI+OQyf9Lydj6EPH+Wcr4Ww8svQvfVOsQIEvOYAPvdqzhA==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 12 Aug 2022 18:14:25 GMT

GET
H2 200 LbmZCDFNYok.js Show response
static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/ Frame 0009 130 KB
37 KB 37ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

022faf125f122d1c715d2c7d3bc274b0adcf8c394a08972057c2078b1f853ff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: /QE2nMkhHBFmtdKo2kfA7Q==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 36817
x-fb-rlafr: 0
x-fb-debug: xaKLecghGSC6TIQ5e4BGO2YbCF9w6uAI2+Nm5ZJPAhrBV881WBP7cy1wWSmOg94iESXB0iQbgnHTBnUbN2iVcw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 00:43:13 GMT

GET
H2 200 g8k43lnQ7E5.js Show response
static.xx.fbcdn.net/rsrc.php/v3iUz84/yP/l/tr_TR/ Frame 0009 16 KB
5 KB 48ms
21ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iUz84/yP/l/tr_TR/g8k43lnQ7E5.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d5decaef1cf2a7030d58e9689486f8cbf049fc0d89ac12f3729743e5cedda6f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: LbZJL8AxxZnX1W8kMz8PGA==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob:;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 5245
x-fb-rlafr: 0
x-fb-debug: QObAn4NsRpx38NAaHpPe9I9TsFQudn1DSwS2cCqQHRx4/k8XZj16YpPK/IrC+LRQ2mymsoNMITS6MNC5ocGctQ==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:33:01 GMT

GET
H2 200 D6mOXAYkkis.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yN/r/ Frame 0009 10 KB
4 KB 37ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yN/r/D6mOXAYkkis.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e460d2f4a4bcd89ee69788e97a770479f30c11442ae94430ecc83ae2d60fb13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: tQHB9ZPry3nO9pgn7cwAeQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3457
x-fb-rlafr: 0
x-fb-debug: X49RgTC3YhLeN+1UUU8vaI/K6sj7dZFU88K3s/XMOdJgJbnozY6E9XgLlUanHlssZmShQXWxEiuxB9rqXgHaGw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 00:20:44 GMT

GET
H2 200 I6bbPmJMDVr.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yx/r/ Frame 0009 153 KB
45 KB 36ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/I6bbPmJMDVr.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

26f9321adbb48980c48e7614fc682581346172514dc2786be1bafb5007197037

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 3Pny8oKYJoOSaNhUqmBGgA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 46182
x-fb-rlafr: 0
x-fb-debug: Y7J+M4SKEXIN+dob5dSIXBPHEsWmEbB1Y1CJZ0gLjz7KSGWo4QtnQpDU78FULcg7zqf3nb+ocUEjuO5PIJKIUA==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 13 Aug 2022 01:22:45 GMT

GET
H2 200 yousnbRo0-R.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ Frame 0009 9 KB
3 KB 47ms
20ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/yousnbRo0-R.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5737cf798d4dda6b0a9f7119f4ed472213769167acd13a235fb920917bde817d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: bW9vsHXH9YkbbtG1+bEHQw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2502
x-fb-rlafr: 0
x-fb-debug: f/p5G1mJjJ0e2fZu0MNICGZE7FCFZj2IQi7Rhlqr9+ychHqKb0/CMa+/nsjLpEoPRb0vMOb22HnQhHGDGk5NZA==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 02:16:29 GMT

GET
H2 200 Vw4y57TdJLk.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yh/r/ Frame 0009 4 KB
2 KB 35ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/Vw4y57TdJLk.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

63120ebeacf1997f60bc2a926346877a23143dca8611ef1a2a31b56a1649716c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 17wndI7E+/3TvkYvKn8UzA==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1596
x-fb-rlafr: 0
x-fb-debug: 8VCrBXfLDoR1VnHy+uXYiIkMIMptOW6J7EhT8qWOSLR4LWYmpLGr5XCRBf2SBl5wnDm+7U0gGpJNfXCrJik3FA==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 06:44:38 GMT

GET
H2 200 oojX0gHvjt8.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y7/r/ Frame 0009 1 KB
648 B 46ms
20ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y7/r/oojX0gHvjt8.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

91138c41961a35d849d3cfe00ed582a61a80a2ae33b0f9d5bc0a4eabf98c6127

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: WjCQ32aON6IudKuf3ZqGhg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 457
x-fb-rlafr: 0
x-fb-debug: b4SS1x+hYrYoe7UFppTTnW1elcYCgS2fH+/RFstFhdytva34i9T0HS8Q5kNKRBQ83hY5Hc2uLAnPXFaHnk2XqQ==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Mon, 15 Aug 2022 16:54:14 GMT

GET
H2 200 10659284_688722784541478_1113697741096065586_n.jpg
scontent.xx.fbcdn.net/v/t1.18169-9/p118x118/ Frame 0009 13 KB
13 KB 9ms
7ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t1.18169-9/p118x118/10659284_688722784541478_1113697741096065586_n.jpg?_nc_cat=105&ccb=1-5&_nc_sid=dd9801&_nc_ohc=JjJPX7hZd1wAX8u6Zhh&_nc_ht=scontent.xx&edm=AGrQwCAEAAAA&oh=9a2dc8bb10eb2a49e50251a58429157d&oe=61425624
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 7ffd27c128c00e42048c9df292d008e7782f087d9ab966183695eb108915c6e8

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 1728454570
date: Tue, 17 Aug 2021 17:57:48 GMT
x-fb-trip-id: 686109401
last-modified: Fri, 12 Sep 2014 12:28:36 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1249673849
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 12847

GET
H2 200 903208_451494281597664_2139334139_o.jpg
scontent.xx.fbcdn.net/v/t31.18172-1/cp0/c10.0.50.50a/p50x50/ Frame 0009 1 KB
1 KB 8ms
6ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t31.18172-1/cp0/c10.0.50.50a/p50x50/903208_451494281597664_2139334139_o.jpg?_nc_cat=111&ccb=1-5&_nc_sid=dbb9e7&_nc_ohc=IbHjY6QZIngAX_x2eE8&_nc_ht=scontent.xx&edm=AGrQwCAEAAAA&oh=6ebf2b5ed42de0429f8e72871e9e8597&oe=61414F8C
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 73f955332cf5acaffdd8f2e8fdafa3369fc72002ad7686a95a96fee4eb51a291

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 1425013494
date: Tue, 17 Aug 2021 17:57:48 GMT
x-fb-trip-id: 686109401
last-modified: Mon, 22 Apr 2013 14:40:32 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1420095690
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1119

GET
H3-29 200 320x100_atlas_P_1.png
s0.2mdn.net/10978836/1625049614695/images/ Frame 68F1 63 KB
63 KB 11ms
7ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10978836/1625049614695/images/320x100_atlas_P_1.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ce105611ef5dd0ce259fbea30e1a2377beb53ec36be96ced276a1e20ec0df6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10978836/1625049614695/320x100.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 23:46:04 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Jun 2021 10:40:14 GMT
server: sffe
age: 65504
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64845
x-xss-protection: 0
expires: Tue, 17 Aug 2021 23:46:04 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ 0
23 B 66ms
64ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1CAA 0
23 B 67ms
65ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 googlelogo_color_150x54dp.png
www.google.com/images/branding/googlelogo/1x/ Frame 936F 3 KB
3 KB 29ms
29ms Image
image/png 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png

Requested by

Host: apis.google.com
URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&origin=http%3A%2F%2Fzaytung.com&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
server: sffe
content-type: image/png
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3170
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H/1.1 200
OK ESHX-PsTG84Fy6-bdaEnL5--1XpTzSOdL-kezmPtlCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame C979 35 KB
15 KB 14ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/bg/ESHX-PsTG84Fy6-bdaEnL5--1XpTzSOdL-kezmPtlCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: http://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1121d7f8fb131bce05cbaf9b75a1272f9fbed57a53cd239d2fe91ece63ed9424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 11:28:06 GMT
Content-Encoding: gzip
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
Last-Modified: Mon, 09 Aug 2021 14:48:00 GMT
Server: sffe
X-Content-Type-Options: nosniff
Age: 23382
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Accept-Ranges: bytes
Content-Length: 14946
X-XSS-Protection: 0
Expires: Wed, 17 Aug 2022 11:28:06 GMT

GET
H3-29 200 6797253813007134951
tpc.googlesyndication.com/simgad/ Frame 30EE 104 KB
104 KB 16ms
13ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6797253813007134951?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnFOeD9wj3iGAwhf4FVZ83iOIdVHw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0f41667aa2c87263da5a6335162ddceb098029e75d06f94c91da4cd31d12638

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:05:46 GMT
x-content-type-options: nosniff
last-modified: Mon, 16 Aug 2021 12:17:54 GMT
server: sffe
age: 96722
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106509
x-xss-protection: 0
expires: Tue, 16 Aug 2022 15:05:46 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 30EE 18 KB
7 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 30EE 0
0 32ms
31ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cn8rAm_gbYfDDGdS_lgS9nq7QAtXa5cJknuLn-ZMOwYTA_PoBEAEg9ZS4FWCVAqABloGf1QHIAQKpAi_LRqM4OYE-qAMByAPJBKoE9AFP0IQmQoLwtvmYdYNdmPFcWQ4cN4cYtu2phdXGrlDV4ycGfIIY1QvUtVlvvT3fZU3znmioU8pnXa84WkvwHSuJY3z-9Rvuj_EeKUGQig-7e4EYSxtUcgwyeMrWJheYFgu6UgBHBuBVgrREHA7idFStzRHC-bAOwJAsO-93HLHE0SFjZKAuV3AjJ1Db0pNmTvD06zfCNT_Oehp0qavcb6Fz6Emib4MUQAE8FigY1Y3jgRxABx1QmB5VMLn1747RErLMS6n4oxxHEwn6AFdQH4gNNcqR-F40SX-IUhVnNzk7T5Nw1psGeS9ubEuAicLXxIXuk_xJwAT8o7Pq0gOSBQQIBBgBkgUECAUYBKAGAoAH6M68qwKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQqZcH0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTQyODU1NjEwODc1NzQwMjQYAA&sigh=7IxvN_aDeLo

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 30EE 2 KB
1 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 30EE 14 KB
6 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 30EE 0
0 20ms
19ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRoR9CITSVa85MciQ2qUgjtPUfvox5xrcHg75_VSERJGEW1rxxHp3cRVofA7gXI4DmQyXhpHp1UhSGT6F_wWRVQPvzmQg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 30EE 124 KB
37 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 30EE 26 KB
11 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2964eaaa17b81ff911681e57089511c35c7ebbbb8cce98e8c64bad2de197149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:35:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10743
x-xss-protection: 0
server: cafe
etag: 8915488205478863544
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 15:35:19 GMT

GET
H3-29 200 577784090764284001
tpc.googlesyndication.com/simgad/ Frame F791 39 KB
39 KB 27ms
6ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/577784090764284001?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qm6fGeUBFfJVMVeweCwx65P3oMCpQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8076c68d74b3580743e4445d714c100871b1fffb259fe86d787fe52ea7585b97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 16:51:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 04 Aug 2021 16:30:28 GMT
server: sffe
age: 435958
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39897
x-xss-protection: 0
expires: Fri, 12 Aug 2022 16:51:50 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame F791 18 KB
7 KB 17ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:31 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame F791 0
0 38ms
30ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Crr9Hm_gbYfDEIYSblgSZlY64CJW3-MdkvtmyhIgO5-OivcABEAEg9ZS4FWCVAqABn_qPvAPIAQKpAr2mLVHLRmM-qAMByAPJBKoE8AFP0IQDNOLNV9d5WLRWF_9fcJUFFnfDmDaBvZYaLnC6v2ALY-tbaFnv7dCrZM4B51cxAYnhemBPJnmdFSfLt8p8viDyxV8wf9nAGjrlNXyfN9Pl91dYDKBQEsio0htbVYUu8xW708AjyYpY4VTcQibO516dsW_quzm-prK-bGiXzN4VQVlPu08Pzom0hNSR1kWaiBzFfs7SSdkMNmKjZzsweDv3sOlLUXF7CYdLYkLeqRznctVt661j_nJwbJQq149trUR9M_mcGB4uGesotWkOk-Lr3PO5cVTBHb18FxIqF0nPSTlsUh_lHi69w34xwtnABI6l2_fOA5IFBAgEGAGSBQQIBRgEoAYCgAf66N9CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEPiiB9IICQiA4YAQEAEYH4AKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi00Mjg1NTYxMDg3NTc0MDI0GAA&sigh=fYGaPXi5VVA

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame F791 2 KB
1 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:55:17 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame F791 14 KB
6 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:56:45 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame F791 0
0 27ms
14ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR3oq0Vn-RYnz68tauWh0Kv2qqfp_JzelXS3HrWSy9rU8GYGFCT-e7Mwep-AYXXiRYouGvX4sHwVyNiwYD5j6IP27pF0Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F791 124 KB
37 KB 30ms
25ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame F791 26 KB
11 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2964eaaa17b81ff911681e57089511c35c7ebbbb8cce98e8c64bad2de197149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:35:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8549
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10743
x-xss-protection: 0
server: cafe
etag: 8915488205478863544
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 15:35:19 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D556 22 KB
8 KB 11ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 17 Aug 2021 09:11:53 GMT
expires: Wed, 17 Aug 2022 09:11:53 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 31555
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2D12 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:42:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 891
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B2BC 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 17 Aug 2021 03:09:05 GMT
expires: Wed, 18 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53323
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 49C7 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:42:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 891
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 17E1 1 KB
749 B 8ms
7ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 17 Aug 2021 03:09:05 GMT
expires: Wed, 18 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53323
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7F0B 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdfdd2cfbde9c88c4aceeeffea47a3f74051863912ef8229f4d0561b33144716

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C768 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 17 Aug 2021 03:09:05 GMT
expires: Wed, 18 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53323
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 1CAA 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0c966c96e68f094bc162fbdf8a1d98788fab813bdbce87eb4b5f2ff9cb14acb

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 667A 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7888556bd1af991290445183094b24aca96c11d1d701df456e2443e1c2c82c1c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4696
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH0vJxeA5NvXywBiAq6hMzk&google_cver=1

43 B
1014 B

115ms
48ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH0vJxeA5NvXywBiAq6hMzk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:48 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 17:57:48 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH0vJxeA5NvXywBiAq6hMzk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4696
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRv4nDFU0-nVI66PK4U-RAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG1aK3iTsxXMqWxa8Ctbg7U&google_cver=1

43 B
894 B

48ms
47ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG1aK3iTsxXMqWxa8Ctbg7U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 17:57:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG1aK3iTsxXMqWxa8Ctbg7U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4696
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELP6PMcMVpiMFYAnOc3_Rb4&google_cver=1

43 B
1004 B

86ms
28ms

Image
image/gif

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELP6PMcMVpiMFYAnOc3_Rb4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKiVRBDv1GYYkIeZsQEwAQ&v=APEucNXkiUZ035num9hoCLmWU9R9JnFXvedT08T-EZQjVseY6mt-XrfjVnr53cYI27FFCXvZKd6pHJGDXbybtFr63hhbFdf9NbeTINmuwUrdZSb_NEwI0D1iLrcsQTFhU_4f0dSMIxxRsB18zb2eTOLXija34m6SZ8m0bdowZIAWt4pq4cTTrYQ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:48 GMT
X-Proxy-Origin: 82.102.18.114; 82.102.18.114; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d0ce7578-1600-405e-bfe4-b15ae89420e7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELP6PMcMVpiMFYAnOc3_Rb4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4696
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D&google_tc=

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D&google_tc=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg3NzYyNjc3MzcxNjc5MTE0OQ%3D%3D&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0EA7 143 B
163 B 9ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnZl7JhlOfA8c-ktuB-n5OMhwWEEoNOwG-JJmS4BP0G4GTiLWy4hLnWqTHd_6M; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 17:42:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 891
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4C5D 1 KB
749 B 12ms
7ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 17 Aug 2021 03:09:05 GMT
expires: Wed, 18 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53323
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 30EE 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21982a18f1360637951a71b7cf95e5aa0828f76829f35345e4cac3b68ed67cc2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 2038943760-postmessagerelay.js Show response
ssl.gstatic.com/accounts/o/ Frame BE7E 10 KB
4 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/2038943760-postmessagerelay.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fzaytung.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.4sn9RO63fqo.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bd9ca2f57b6c388332dd095d8c9be87dc71c2e1b78b843515ae758fe05a1223

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 16:39:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91127
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4265
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 22:27:43 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 16 Aug 2022 16:39:01 GMT

GET
H3-29 200 rpc:shindig_random.js Show response
apis.google.com/js/ Frame BE7E 13 KB
5 KB 55ms
54ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/rpc:shindig_random.js?onload=init

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d99dccc4af2dcb8e3b64249fb88549b5f0368708eec4b4c0acadc177b3ddce75

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h1PHzfpUxSSZOv9EAGpPQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "27112d2024262eac57ac21d95a79218e"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-h1PHzfpUxSSZOv9EAGpPQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Tue, 17 Aug 2021 17:57:48 GMT

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D16B 1 KB
749 B 8ms
6ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 17 Aug 2021 03:09:05 GMT
expires: Wed, 18 Aug 2021 03:09:05 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 53323
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 mOcgOmDDSbN.png
static.xx.fbcdn.net/rsrc.php/v3/yL/r/ Frame 0009 1 KB
1 KB 9ms
7ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/mOcgOmDDSbN.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3dc936b3c6e476fbbbfea1c5d962f4bee0e3636450608357ffcf9e6e92e0d596

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: EQW5xbTH+4NHoekjAPZYMQ5L5d3NAs1wVKX1iTT/6yW+tg1BSdq+eO3aguaiTeLoU+ydP727hz0rNkF+Pf8TSg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 2bKr5oI1XogALo4o3p6kDA==
date: Tue, 17 Aug 2021 17:57:48 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1193
x-fb-rlafr: 0
expires: Wed, 10 Aug 2022 15:47:41 GMT

GET
DATA 200
OK truncated
/ Frame F791 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bc4d75b2d1a4bdac9690acfec2c49825fa64a151f08f1d89f87b48662180900

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6EA6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
177 B

15ms
15ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:48 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 17-Aug-2021 18:57:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:48 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:48 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 settings Show response
syndication.twitter.com/ Frame B4E5 232 B
432 B 207ms
139ms Fetch
application/json 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=e83a46cb02ae3984d4b9e5a5d858a9fbec8a99b1

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=http%3A%2F%2Fzaytung.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:48 GMT
content-encoding: gzip
last-modified: Tue, 17 Aug 2021 17:57:49 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: cec8f55390da43ad7f480632357d7b93f48005519076a6ba9771b5b3c951e5ce
content-length: 166

GET
H/1.1 200
OK st Show response
imprammp.taboola.com/ Frame 85C1 0
256 B 69ms
48ms Document
text/plain 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://imprammp.taboola.com/st?cipid=7991117&ttype=0&cirid=BFFF74B5BD622161551465014654&cicmp=1337627&cijs=1&dast=V79v4CFgMx4ZFo0aUEZgQx4ZFo0aUEZgUAAAAGBugHG0Kj0XijCWtCok0mi9liNRqNdoPlZrmcLCFhFovFaDJbDadgsIXP6e5uwwSaTofrXi99OE-vu8-u8bv9cgAAAAB4ACBqiYbY8W1ojwAAAACQ4Bm5VqAIqPi3ELgAAAAAwAAgEAvXAEjiIHCnx-UPAICHAhAAAAGMEAC_cWERAAAAgBEAAAAAEgCBxMISAIe7RRMAgIC9qiGRjRMAAICDOpmnbZb_____GIC89yYZAIq0jRuDHoAHH4AHIQAAgIshlNIzW-TKWAiiAsUiRgAAAABSZhJyR5I6obKo-v___7cCuAIACNirGhKRybo5KWYNAwAAABhboIfF7zc77Bq_22X__________2b_ZwBoQi7MzWlA6AAAajwj1wprv4AAAGzvBgDwJgAXcwB2AAAAAHf_____eQAAABN7lGyv1Xj2KOt9Blv4nO7u-k3YYrSaTDbL4Wy5mAyGo-FotD8BXA5wIgbL5WSymOxWo9VoM9yNZoMFCsRgghQtGkxWo9FkMRmuRpPVbLnY7TZI0arVbLQZDFezyWy3Ww0Hw-VohBO2GK0mk81yOFsuJoPhaDgaDfGg6lw6n1en4sF8XM597cHHBpzMFYPJXDGcKxajVQIAAAAAAAAAWMKUeRMAAACA0yBms8lut-LGmz0TxFqtljUAAAAAt27kAA!&excid=22&tst=1&docw=0&cs=false
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: imprammp.taboola.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://zaytung.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

Server: nginx
Content-Length: 0
Accept-Ranges: bytes
Date: Tue, 17 Aug 2021 17:57:48 GMT
Via: 1.1 varnish
Connection: keep-alive
X-Served-By: cache-fra19122-FRA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1629223069.964321,VS0,VE9

GET
H/1.1 200
OK cmTagCUSTOM.js Show response
vidstat.taboola.com/vpaid/units/28_3_10/infra/ 727 KB
167 KB 31ms
30ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/units/28_3_10/infra/cmTagCUSTOM.js
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/27_2_17/creatives/creative_js.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa7c984cd510935c132345bc7d579dfcde68742f7b11b599b905310f7164718c

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Via: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6df.cloudfront.net (CloudFront), 1.1 varnish
Age: 1690715
x-amz-meta-mtime: 1605697169
X-Cache: Hit from cloudfront, HIT
x-amz-meta-ctime: 1605697291
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 170200
X-Served-By: cache-fra19138-FRA
Last-Modified: Wed, 18 Nov 2020 11:01:34 GMT
Server: AmazonS3
X-Timer: S1629223069.935581,VS0,VE1
ETag: "372eb1c4c65924583135c879a057ddd5"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: t55tGajXcWulVpFqPxPMEqbiVJI9DrISQO0TIPGczMQdYZtCmRSFBw==
X-Cache-Hits: 1

GET
H/1.1 200
OK cmOsUnit.css
vidstat.taboola.com/vpaid/units/28_3_10/assets/css/ 44 KB
8 KB 30ms
30ms Stylesheet
text/css 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/units/28_3_10/assets/css/cmOsUnit.css
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/27_2_17/creatives/creative_js.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4e7681cdfb27c5d0457c58c9f0fe26a68bbf6a8dc88defd3c43826adb1fe6ca8

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:48 GMT
Via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront), 1.1 varnish
Age: 1094885
x-amz-meta-mtime: 1605697165
X-Cache: Hit from cloudfront, HIT
x-amz-meta-ctime: 1605697253
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 7295
X-Served-By: cache-fra19151-FRA
Last-Modified: Wed, 18 Nov 2020 11:00:55 GMT
Server: AmazonS3
X-Timer: S1629223069.935497,VS0,VE0
ETag: "974f115b22388eba3c19a5907f61740d"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Type: text/css
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: m-lQRKORziHm8bwrGBq38648Hi0ZADmPa6En77NvPXW2QovKkY6fFA==
X-Cache-Hits: 3937

GET
H2 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame 0009 1 KB
869 B 47ms
47ms XHR
application/x-javascript 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%221554908878104117%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F%22%2C%22width%22%3A298%2C%22height%22%3A600%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Atrue%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22http%3A%2F%2Fzaytung.com%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__dyn=7wKBz84e1QyUbFp63m1FwAxu13wqovzEdEc8uwdK4o6O0TUhwem0nCq1ewcG0KE33wooa81Vrzo5-0me0sy0SU2swdq0Ho2ewnE0Caaw&__csr=&__req=1&__hs=18856.PHASED%3Aplugin_default_pkg.2.0.0.0&dpr=1&__ccg=EXCELLENT&__rev=1004264780&__s=%3A%3A46dhdd&__hsi=6997459791363748170-0&__comet_req=0&locale=tr_TR&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3f25a37faa0703cae1dad16a35bc0bc31b89921732a5b6ac9502ef05732be79a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: Jb-SPFyRfW0n5YSEScMAaX
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: 01JyaZWN+KPfCvUupLCvxg3zGiSWz8gy2p+xI1Lza/VRBPPiaZiVBxlAGNDVroc2gD4hojhAVWWIMZAMZyJDrg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 17 Aug 2021 17:57:49 GMT
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame 0009 1 KB
821 B 172ms
171ms XHR
application/x-javascript 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2f0ada681035b5624a2bf0d70db2c9c36db8ad51add41c434013db478ce79c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: Jb-SPFyRfW0n5YSEScMAaX
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: BnMZbuZikBfYozjULp3m/sTJUI2JoJ0GgPB+aHFVQDdaDVYHD/1BgHWk+yvPgYcOpmmykOWO0oLl3fqpoAcbuQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 17 Aug 2021 17:57:49 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 C07F_TNoyQ0.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yT/r/ Frame 0009 19 KB
6 KB 10ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yT/r/C07F_TNoyQ0.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8040782c684c1c1b373a0c84d042cd3b4e953dfeec2894962424d576e2347cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: F2+o0UpT6xz/iezbo90yWw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 6351
x-fb-rlafr: 0
x-fb-debug: w06a301A3gN3Qia84IghsEQEvG+6xvSF67ssNLPoViDZhIRPAvUJ+6EFwIPyHaWFc0QlxL8Y031CG6HXBjm2/g==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sun, 14 Aug 2022 02:05:24 GMT

GET
H2 200 cN-N4Eu_deZ.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yv/r/ Frame 0009 7 KB
3 KB 10ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/cN-N4Eu_deZ.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

095eceabca5358699a8efc64f4e44b27576d45c2ab864f1f50c3401676f9a827

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: XkHzn1WHKMxOAJmWI3FJ7A==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2277
x-fb-rlafr: 0
x-fb-debug: 6VsbggWm5BEcRhsn1yT6craKDnHiGbOyISmWIXBsbqcC2jdW9ja3j0cUMcJD1F+Ggnh8VywB6Gbkjw2wcHNA6w==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 12 Aug 2022 05:30:00 GMT

GET
H2 200 onuUJj0tCqE.png
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ Frame 0009 4 KB
4 KB 8ms
7ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/onuUJj0tCqE.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5f71fcc2d00d22ffd4d9a07b64c435f88de80893f838fa64a45c386cbba0c601

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
x-content-type-options: nosniff
content-md5: OK0dmVpVmdoMRpKMP9eDcg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3944
x-fb-rlafr: 0
x-fb-debug: UpEjWmOL4QHl/yQwqJlcFeZGhQ5rJz0mOIOXovJuOwggOg3CIYJF8oJ5nSnv4Jd9ljbq5m66OBp9VGsphw+VMw==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 02:33:10 GMT

GET
H/1.1 200
OK st Show response
imprammp.taboola.com/ Frame DF13 1 KB
919 B 48ms
42ms Document
text/html 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 86d0b0c5c5ac215d1bccc0057a9e5aeaf96554438e7eacc1c8d53f9f3f827b26

Request headers

Host: imprammp.taboola.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://zaytung.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

Server: nginx
Content-Type: text/html;charset=ISO-8859-1
Content-Encoding: gzip
Transfer-Encoding: chunked
Accept-Ranges: bytes
Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 varnish
Connection: keep-alive
X-Served-By: cache-fra19122-FRA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1629223069.114594,VS0,VE14
Vary: Accept-Encoding

GET
H2 200 sync Show response
am-match.taboola.com/ Frame A4B4 1 KB
1 KB 110ms
34ms Document
text/html 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 86d0b0c5c5ac215d1bccc0057a9e5aeaf96554438e7eacc1c8d53f9f3f827b26

Request headers

:method: GET
:authority: am-match.taboola.com
:scheme: https
:path: /sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

server: nginx
date: Tue, 17 Aug 2021 17:57:49 GMT
content-type: text/html;charset=ISO-8859-1
machineid: 3402

POST
H/1.1 200
OK VideoBidRequestHandlerServlet Show response
wf.taboola.com/ 1 KB
1 KB 112ms
91ms XHR
application/json 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=416&height=234&pubid=169497&tagid=953497&crid=5333395&noaop=5&sortOrderType=0&cb=1629223069102&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=1&pv=1263&pt=-824685103&tz=120&viewable=true&ddast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&proto=2,3,5,6&encoded=1&pstn=vforce2&callback=&wfv=1&amp=0&qsz=7&ft=0&pb=0&pagg=1&sd=undefined&dtagid=1705875&dpubid=286345&abtst=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&mPre=0.033&cirf=http%3A%2F%2Fzaytung.com&en=1
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 51e7fe40a6e46a274f84adeda41f43cfd9ed84266de404e61f46c23d97972d48

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: http://zaytung.com
MachineId: 1410
Transfer-Encoding: chunked
X-Cache: MISS
Connection: keep-alive
X-Served-By: cache-fra19125-FRA
Pragma: no-cache
Server: nginx
X-Timer: S1629223069.143872,VS0,VE54
Vary: Accept-Encoding
Content-Type: application/json;charset=utf-8
Via: 1.1 varnish
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H/1.1 200 st
am-vid-events.taboola.com/ 0
112 B 73ms
47ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://am-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=31589837&cb=1629223069095&uv=3002&tms=1629223069095&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&debug=pn:!sqg:!torgn:1629223064917.5!ts:1629223069095&mntl=1
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EA98 42 B
174 B 39ms
34ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssbGFTxFJrVPmAA8iaWMLE-vtAGBIUOIpXVjYyLdTNU__ALGmdiYVQseVhjANdMaQMJHtSjCq00oE3CO6DBU5UcCg_fQVrNEZmFyWm-uE_MNl7R2w7Mq0H-Ehf3RDxQY5aXvIeQ68g7yz8in3JXQl4P&sai=AMfl-YTCDb3VsrYZ9kWsMfvWKdltker46EJCrvrPayP_JopXxOT_MIJQA_1wCs0djqjN5zgikFacY-NR9OXexS9akNmf08b8-OusEXw&sig=Cg0ArKJSzB_kIJk5I_JoEAE&cid=CAASF-Ro4ORwYh5YI9v9t7foM10QxOkxxZqL&id=lidar2&mcvt=1114&p=226,312,476,1282&mtos=1114,1114,1114,1114,1114&tos=1114,0,0,0,0&v=20210816&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=921463585&rs=2&met=mue&la=1&cr=0&osd=1&vs=4&eosm=0&rst=1629223066686&dlt=601&rpt=1226&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/ Frame BE7E 50 KB
18 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.4sn9RO63fqo.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO5GqPeHrbNQGs79bP09BnjVkdwag/cb=gapi.loaded_0?le=ili,ipu

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ded3de6711e90ee906834dbd64ff18636b3f1a2463825e13f2fa0600417bfe2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 16:26:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 523853
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17956
x-xss-protection: 0
last-modified: Wed, 07 Jul 2021 13:43:54 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 16:26:56 GMT

GET
H3-29 200 OZcLupMIkEN.js Show response
www.facebook.com/rsrc.php/v3/ya/r/ Frame 0009 245 B
217 B 7ms
7ms Script
application/x-javascript 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/ya/r/OZcLupMIkEN.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1012db27ec1cb433b46f471bb11c18fec71f59c5fa6f6520c87ff374e4ef0325

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfddfaa7705a1c%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=298&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 02:06:29 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Sj0Q4egSj1eTua951vhlbw==
cross-origin-resource-policy: cross-origin
content-length: 165
x-fb-rlafr: 0
x-fb-debug: rjqs/y4egkYfje0bvPclxN8M3xdF4znLrUwTG8Te6KjIcxT9NICjHEHxfKClKiUOyFGeJ2vfYur0yyMAhWMu1A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:06:29 GMT

GET
H2

200

redot.js Show response
gdetr.hit.gemius.pl/__/_1629223069178/
Redirect Chain

https://gdetr.hit.gemius.pl/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%3D0...
https://gdetr.hit.gemius.pl/__/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%...

2 B
177 B

39ms
39ms

XHR
application/x-javascript

92.222.252.172
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://gdetr.hit.gemius.pl/__/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.222.252.172 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip172.ip-92-222-252.eu
Software: GHC /
Resource Hash: 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
access-control-allow-origin: http://zaytung.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 2
expires: Mon, 16 Aug 2021 17:57:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: GHC
access-control-allow-origin: http://zaytung.com
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1629223069178/redot.js?id=bQc7KU7geHI1t1Qcz6iFLvUIP30pD6NfRdgAgASnYcH.D7/stparam=lkhjcxjtfh&extra=isn%3D0%7Cisn_d%3D4260%7Cisn_s_v%3D3v4d_4%7Cls%3D1%7Ctpb%3D0%7Cifr%3D0%7Ctq%3D1%7Chct%3D1125&lsdata=-NOTSUP&href=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 16 Aug 2021 17:57:49 GMT

POST
H2 204 bulk Show response
trc.taboola.com/zaytung/log/3/ 0
291 B 39ms
39ms XHR
image/gif 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/zaytung/log/3/bulk?route=AM%3AAM%3AV&lti=deflated&bulkSize=1
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-vcl-time-ms: 9
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
via: 1.1 varnish
server: nginx
x-timer: S1629223069.194890,VS0,VE9
x-served-by: cache-fra19148-FRA
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: http://zaytung.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame B77B 35 KB
13 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H2 200 logo-blau.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 5 KB
7 KB 9ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/logo-blau.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dd6aa34058c7014b4bd6aede0d669bd0642d173e39a723178dce532f317657f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 51146
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5389
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 03:45:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 03:45:23 GMT

GET
H2 200 cta.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 2 KB
2 KB 16ms
14ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/cta.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a846273fa4ea7bff5c30208e231892c7357097f02f351b9e483ffcda21651d3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 43213
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1625
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 05:57:36 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 05:57:36 GMT

GET
H2 200 keyvisuals.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 695 B
787 B 15ms
13ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/keyvisuals.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7332b300fff81f63aefec1e2b0c072ee9c28c4565ada0376cd3f0276b99cf01

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 19361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 695
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 12:35:08 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 12:35:08 GMT

GET
H2 200 dieschoenste.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 5 KB
5 KB 12ms
11ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/dieschoenste.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22f64f87aa926a55ffdcee4b8d2b378890f8b28c12ca7167c7ee674f060e8091

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 27076
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4855
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 10:26:33 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 10:26:33 GMT

GET
H2 200 makrelen.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 23 KB
23 KB 18ms
17ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/makrelen.png

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2bebff6cf5001f3e217eb00e7d68292251a5835f922e2936eafaab13eafc7c5

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 51146
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23955
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 03:45:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 03:45:23 GMT

GET
H2 200 moodbild.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/ Frame B77B 53 KB
53 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10023993934787577230/moodbild.jpg

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8734a99f4970946ef7bae7da6da9f0817a98ab64cd305da2a9b6f515a26ff210

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 51146
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53893
x-xss-protection: 0
last-modified: Fri, 16 Nov 2018 16:18:27 GMT
server: sffe
date: Tue, 17 Aug 2021 03:45:23 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 03:45:23 GMT

GET
H/1.1 200
OK PMS.js Show response
vidstat.taboola.com/PMS/2.2.1/ 51 KB
16 KB 35ms
28ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/PMS/2.2.1/PMS.js
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/28_3_10/infra/cmTagCUSTOM.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a9e402d2d19f1057cdea09b2152d8cfd35664182564595e19bb83916c1f00201

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront), 1.1 varnish
Age: 2882446
x-amz-meta-mtime: 1542789750
X-Cache: Miss from cloudfront, HIT
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 15795
X-Served-By: cache-fra19138-FRA
Last-Modified: Wed, 21 Nov 2018 08:42:31 GMT
Server: AmazonS3
X-Timer: S1629223069.250600,VS0,VE0
ETag: "57a7ebef371550a9ab54a2f0f82547af"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: oi7QB5C8BA-557rR6kkZ3x1Oul_9ZzX57MiZnxZZQZZUyJL57XdM5A==
X-Cache-Hits: 587995

GET
H/1.1 200
OK cmTagWIDGET_ITEM.js Show response
vidstat.taboola.com/vpaid/units/30_0_2/infra/ 668 KB
147 KB 57ms
38ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/units/30_0_2/infra/cmTagWIDGET_ITEM.js
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5109449fc589b78ebb2c44adad5a57e3ee9f7272ff932e567f7c96fd659b6a75

Request headers

Origin: http://zaytung.com
Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront), 1.1 varnish
Age: 129927
x-amz-meta-mtime: 1629092935
X-Cache: Hit from cloudfront, HIT
x-amz-meta-ctime: 1629092936
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 149166
X-Served-By: cache-fra19181-FRA
Last-Modified: Mon, 16 Aug 2021 05:48:57 GMT
Server: AmazonS3
X-Timer: S1629223069.300206,VS0,VE0
ETag: "8a6ccabb4a6eaee099b4a3eefbfffa90"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: AKZI6ZQIoybkMcK-_yPZZ8yNOskip5-dtxcgm1rEI3efrSfgzFmz0Q==
X-Cache-Hits: 296

GET
H/1.1 200
OK cmOsUnit.css
vidstat.taboola.com/vpaid/units/30_0_2/assets/css/ 60 KB
10 KB 32ms
31ms Stylesheet
text/css 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/units/30_0_2/assets/css/cmOsUnit.css
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/lite-unit/3.5.0/UnitWidgetItemDesktop.min.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6e07734fe1015f88d67a257108878aed46f82946feba5973a0d306aa927ad71a

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront), 1.1 varnish
Age: 130012
x-amz-meta-mtime: 1629093001
X-Cache: Hit from cloudfront, HIT
x-amz-meta-ctime: 1629093002
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 9231
X-Served-By: cache-fra19151-FRA
Last-Modified: Mon, 16 Aug 2021 05:50:03 GMT
Server: AmazonS3
X-Timer: S1629223069.272114,VS0,VE0
ETag: "332be01610736e061c892d8695dc07d9"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Type: text/css
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: THCndQYS-WqMdDXdZtHJO8cIEPBXsWLC_StLKYSifGCYB-cESxa5og==
X-Cache-Hits: 10493

GET
H2 200 dpixel
cms.quantserve.com/ Frame B2BC 35 B
464 B 19ms
11ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPI3Qn7r-vsdlxiGApwbjVtWcOMw3vpo5PEVqzPvt5rcuBqFYYPu2E1cWFiUoLS3RDqT2_gb8A_ri8tZ9riv_z_Mx8UaZFoX

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B2BC
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHssZ3c7hc1-PIoDriXXrHw&google_cver=1&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s&google_hm=Q0FFU0VIc3NaM2M3aGMxLV...

170 B
188 B

41ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:49 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPIyZn_BK7OJ_gGGG3EIcPwZANqeiPE8mT0quR4nMVIkbU5Pf4xzoKNbWfy5Zebva79FynktXiKU-2WqKDk7pvYoHJeI32s&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B2BC
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&google_hm=xGro3b1uzMEzccykrMj-TQ==

170 B
188 B

40ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&google_hm=xGro3b1uzMEzccykrMj-TQ==

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLXBMrbOeFDi1CZ1J38ZYf8qFverzuAPfaHo6zKdAN6HX4lg16RQ8oAtoJ05ciP1kfMEhARIcqP84WCoT8zynSRvPfOeRbS&google_hm=xGro3b1uzMEzccykrMj-TQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 6eul80m5dm3775ofrgh7das4gcidl4vl

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B2BC
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uamFeVZUT7-esUQWlnk47g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

43ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uamFeVZUT7-esUQWlnk47g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK58Mc6C7-La4pjQG3lszqBpYFqaaQawVeNq2mbgeZA1FbRvq_yGUggDQu7gyjcvLaQpJ0oGzc9_iEFtQJBNF6w2gqeA0c4

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=uamFeVZUT7-esUQWlnk47g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK58Mc6C7-La4pjQG3lszqBpYFqaaQawVeNq2mbgeZA1FbRvq_yGUggDQu7gyjcvLaQpJ0oGzc9_iEFtQJBNF6w2gqeA0c4
date: Tue, 17 Aug 2021 17:57:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B2BC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiU...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMVkwtMjItR1M1Sw==&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiUHe_3Q2GgEEYWiZYS_exTj_Ntr

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMVkwtMjItR1M1Sw==&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiUHe_3Q2GgEEYWiZYS_exTj_Ntr

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMVkwtMjItR1M1Sw==&google_push=AYg5qPLpoSSu1tTuT4HjbJjsVMm0JMb6u5gy1LYUc_71dd4jhs91kRJ_y8U5xEFmQNS1LiQXjiUHe_3Q2GgEEYWiZYS_exTj_Ntr
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame B2BC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NF...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame B2BC 43 B
297 B 93ms
19ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEE2bUQsU7lcIWEDBPATDiDs&google_cver=1&google_push=AYg5qPIKYdSyKSM8PcMsYR7xj1PWAMUeuK5lSJzXiDsTyTJIL3Vua565kImOf50IkEzHf9E_g63UOvma7nS7HSWS_WwAXqE27Ons
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=3388426551&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067227&bpp=1&bdt=1283&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=3592&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=15&uci=a!f&btvi=2&fsb=1&xpc=gITVi30u8n&p=http%3A//zaytung.com&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame B2BC 0
12 B 45ms
41ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ik9wLLKP5x-b7tx134jWaRoN5mEmIKt5CJ_KqGid4e8X_5NvJrZ9ezS1CtlUGZS4Xmdery

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame D556 35 KB
13 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 17E1
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xC...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xCW2iS08vacZ54RDlghdPhM9JxdK54wwKeqljX_z0nmm&google_hm=IGyJIr...

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xCW2iS08vacZ54RDlghdPhM9JxdK54wwKeqljX_z0nmm&google_hm=IGyJIrI7BZf9VaIshEcg-g

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKkhxegqAMKQsGxL6F2Nhm_a-xOBj9ZU4DarOEquycPRtn2RU88xCW2iS08vacZ54RDlghdPhM9JxdK54wwKeqljX_z0nmm&google_hm=IGyJIrI7BZf9VaIshEcg-g
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 17E1
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHssZ3c7hc1-PIoDriXXrHw&google_cver=1&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u&google_hm=Q0FFU0VIc3NaM2M3aGMxL...

170 B
188 B

41ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:48 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLTuKH6dLq3sAu5mQ0QJDVW9Ip0BNWNWYP5bvPRBn--IAbjdlrfq-hY2a1Eyp7aM51Dz-pXobuiTxFnTyrxrooOGyexvj0u&google_hm=Q0FFU0VIc3NaM2M3aGMxLVBJb0RyaVhYckh3
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 17E1 43 B
324 B 89ms
31ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEKHCsWdELQ5oPK_NCrlIOhw&google_push=AYg5qPI0R_NyhQh4DZ2iEUK-7cjtUJUBeKH91_WrKt2GdWUECL9KDGzUrKqrNe6lK8B0GnVOM-tZbBVCfBchzGnBIMtlWUm-fG9h&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 17E1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV0EtUC1HUTVJ&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj4nbuwD3VWwvZxo7-uHn0YyR4

170 B
188 B

51ms
50ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV0EtUC1HUTVJ&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj4nbuwD3VWwvZxo7-uHn0YyR4

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV0EtUC1HUTVJ&google_push=AYg5qPJDaOBXwEoztvsO3n5YooXxqbd1tIqN6kz6rIXXaNwX2F00JxUXisdMocePDpltugEx0Pj4nbuwD3VWwvZxo7-uHn0YyR4
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 17E1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 17E1 43 B
296 B 60ms
19ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEE2bUQsU7lcIWEDBPATDiDs&google_cver=1&google_push=AYg5qPIF3KQnjECDmhnsQd17OvNhWgNDeOvPLvV-i0EFYswDvMTHlxkanp-dBsuzgxgmP-p7B6qZDraMtO1CC8MoGuIItNuHTsQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 17E1
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEFamw8p7p459VYwvdxcF_zo&google_cver=1&google_push=AYg5qPJY_vSF9tuEb26O-kvE...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJY_vSF9tuEb26O-kvEHmu875tjoxqcsghQi5KBN784cMFFSqDwpFi2KUct85bEZ6czTC3Yu0t14gwVi-ub_TgPGsPPGpljPg&google_hm=nmmzplrfgykclef...

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJY_vSF9tuEb26O-kvEHmu875tjoxqcsghQi5KBN784cMFFSqDwpFi2KUct85bEZ6czTC3Yu0t14gwVi-ub_TgPGsPPGpljPg&google_hm=nmmzplrfgykclefwzasuzrxpcynz

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJY_vSF9tuEb26O-kvEHmu875tjoxqcsghQi5KBN784cMFFSqDwpFi2KUct85bEZ6czTC3Yu0t14gwVi-ub_TgPGsPPGpljPg&google_hm=nmmzplrfgykclefwzasuzrxpcynz
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 16 Aug 2021 17:57:49 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 17E1 0
12 B 38ms
36ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LGLL__h6QHK5AaHEX2orCbIt7cnBCzg9Tn-5ewXfev9_vKAlMVL3qfPn5oHCuiOyKXX0LvOA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWV...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWVBOzn7gRFZd1i-PsIzqhIi-AnVK2IGhPugO6lPH5hw&google_hm=IGyJIrI...

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWVBOzn7gRFZd1i-PsIzqhIi-AnVK2IGhPugO6lPH5hw&google_hm=IGyJIrI7BZf9VaIshEcg-g

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL2gqIVTAlQSb_GD8HYPhefIBEaFGDJTC4AfkHQYbZFM3-36P8KWVBOzn7gRFZd1i-PsIzqhIi-AnVK2IGhPugO6lPH5hw&google_hm=IGyJIrI7BZf9VaIshEcg-g
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIX1ABagPcVc-XZnl0Axjy9gdjZY035EJLJznbVPaGTWwbcr25M_KvKt1W2XGLHG26t0RGMWx_KiToiwoGO2mtql8We8A&google_gid=CAESEKNlvaIeAUJOSK8oys_A7gA&googl...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCKDx74gGEgUI6AcQAEIASm5nb29nbGVfcHVzaD1BWWc1cVBJWDFBQmFnUGNWYy1YWm5sMEF4ank5Z2RqWlkwMzVFSkxKem5iVlBhR1RXd2JjcjI1TV9Ldkt0MVcyWEdMSEcyNnQwUkdNV3hfS2lUb2l3b0...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwNkVyYzF5UjEzeEFQQlB3VkN3R0EyMno5SVBSaUs4SG5hVV84Z0lwSnozMA==&google_push

170 B
243 B

38ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwNkVyYzF5UjEzeEFQQlB3VkN3R0EyMno5SVBSaUs4SG5hVV84Z0lwSnozMA==&google_push

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 17 Aug 2021 17:57:52 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwNkVyYzF5UjEzeEFQQlB3VkN3R0EyMno5SVBSaUs4SG5hVV84Z0lwSnozMA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&ox...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&google_hm=xGro3b1uzMEzccykrMj-TQ==

170 B
188 B

42ms
41ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&google_hm=xGro3b1uzMEzccykrMj-TQ==

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLazGsz6jpCNDh-PNdx8eifNtzTbuCaRPaNt6q84vgQr_mngqBbmblpfSnpEaF5HC3Q6A8wdiddY4xFrEV0i-fvJ8z8ZA&google_hm=xGro3b1uzMEzccykrMj-TQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: rn1m4cjftr135tmegb6hob3qjus9td60

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rhOlxunTLiFl1EcoJeE3A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

41ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rhOlxunTLiFl1EcoJeE3A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKG9etAcfjf2hyZjDd3U4gZ_0C9AehJBZPSbxAouTMePjd75x4Z-_3gmcXzURZEzq2cpyfwzynmJqcRednnQiQXrC8B2Vo

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2rhOlxunTLiFl1EcoJeE3A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKG9etAcfjf2hyZjDd3U4gZ_0C9AehJBZPSbxAouTMePjd75x4Z-_3gmcXzURZEzq2cpyfwzynmJqcRednnQiQXrC8B2Vo
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVw...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1ItMTktOENYVw==&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVwoNfDOc37sX-517lK_Pgzwog

170 B
188 B

42ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1ItMTktOENYVw==&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVwoNfDOc37sX-517lK_Pgzwog

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1ItMTktOENYVw==&google_push=AYg5qPI3-lEprgJx4PsAAgRjK0iEj6DlYlTrXtjDue1WZ2IGCwGk6rQyzIzZI1CAvRfQLpu6xVwoNfDOc37sX-517lK_Pgzwog
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame C768
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fD...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame C768 43 B
297 B 42ms
19ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEE2bUQsU7lcIWEDBPATDiDs&google_cver=1&google_push=AYg5qPIs7c53aQIWPxDhFxNWd757IqkI1OdrivGsQdx-zWBXm4eXe6dWVtPg_Xjuv2dugB2Ufa8h230Wy4duuj5cbM-g4Eu9qYI
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=250&slotname=5526137584&adk=2427587244&adf=315773266&pi=t.ma~as.5526137584&w=300&lmt=1629223066&psa=0&format=300x250&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223066989&bpp=1&bdt=1045&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=2193&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=14&uci=a!e&btvi=1&fsb=1&xpc=mo4UXNDWvO&p=http%3A//zaytung.com&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame C768 0
12 B 44ms
40ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IlVx0hgEof73XPEI0pdu_WBLGQWta9KXrkHR6kOCMX6AV1z3t9rbkRTUnN7p8bKNntrc9G

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2D12
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlJNEmIwrThmsCuJD1gtk95RnGrYccrmTG79vHvrQjTlymf-Yw_hWqhC09oWmo
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 17-Aug-2021 18:57:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrw...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrwdwZ48eEHXp6K5-kEA2gEMmi6_rzY95_RlBbAMoU2I&google_hm=IGyJIrI...

170 B
188 B

39ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrwdwZ48eEHXp6K5-kEA2gEMmi6_rzY95_RlBbAMoU2I&google_hm=IGyJIrI7BZf9VaIshEcg-g

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPLIVc3AyPiCPA0018yUeqz2qo9ZRV_X-CqBDFi0oOpKSlsb8ZPlrwdwZ48eEHXp6K5-kEA2gEMmi6_rzY95_RlBbAMoU2I&google_hm=IGyJIrI7BZf9VaIshEcg-g
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKA82Ib...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKA82Ib...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NDkwMDAxMzkyNDU0NjI3Mw%3D%3D&google_push=AYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk...

170 B
188 B

45ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NDkwMDAxMzkyNDU0NjI3Mw%3D%3D&google_push=AYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk_9CZ-3jZ5vktSIlST9bCJtc3caJzA

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NDkwMDAxMzkyNDU0NjI3Mw%3D%3D&google_push=AYg5qPKA82IbI2gYqxQCmYgP1goHEoSlHVirhO2vaiawJxE22pF1NJRtJDOq7SqCd47Hmk_9CZ-3jZ5vktSIlST9bCJtc3caJzA
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 17 Aug 2021 17:57:49 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 4C5D 43 B
106 B 70ms
32ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEKHCsWdELQ5oPK_NCrlIOhw&google_push=AYg5qPKNL_ugxbb13UCZtorB8J9xsa_Tm5JqnuW6CVveJ5nWscHcPp-k1fNbEz75Azmj69P_ap2EsZvgLGPtsXcCbIhFuB9l4EF0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=164&slotname=8225636314&adk=3251078930&adf=616890109&pi=t.ma~as.8225636314&w=640&lmt=1629223067&rafmt=11&psa=0&format=640x164&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067377&bpp=2&bdt=1433&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=325&ady=1418&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=17&uci=a!h&btvi=4&fsb=1&xpc=bUNLgl2zbo&p=http%3A//zaytung.com&dtd=12
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&google_hm=xGro3b1uzMEzccykrMj-TQ==

170 B
188 B

38ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&google_hm=xGro3b1uzMEzccykrMj-TQ==

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJGbMY5fE0BYwfeU6sQqro7FyVI-0PKy2aAKl7fke5Z4BQ8RczWmhRBWhVZValVwuxJyj9BXn9gppe58B7DX8KUHl8w57M&google_hm=xGro3b1uzMEzccykrMj-TQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: j23nmvil2u998v1abgr2vbu1jgh0uoc0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ugpML9J-SjOxApDlcXTOxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

41ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ugpML9J-SjOxApDlcXTOxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHlyowoqXleJVKqDqmylBRjHk4jcFDZlaEEFCqtdL96cH6wvPz6OyJn4xW7M32C3RSpchSnvIN8WZBXH_71GJBQ8ieZsJ9

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ugpML9J-SjOxApDlcXTOxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIHlyowoqXleJVKqDqmylBRjHk4jcFDZlaEEFCqtdL96cH6wvPz6OyJn4xW7M32C3RSpchSnvIN8WZBXH_71GJBQ8ieZsJ9
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9Z...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1MtUC1ISTZL&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9ZAyiLCQpwG6YagbtFUcU_Fi84N

170 B
188 B

41ms
39ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1MtUC1ISTZL&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9ZAyiLCQpwG6YagbtFUcU_Fi84N

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMV1MtUC1ISTZL&google_push=AYg5qPLGsxXt4EL4qBfY8ny8envUlmy0XD92YQtfU7-mRYpXCtDL_Uv40BB5NhKH2RGCulOkl9ZAyiLCQpwG6YagbtFUcU_Fi84N
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 4C5D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-Mm...

0
0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 4C5D 0
12 B 42ms
39ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13INwQf767GeetuHPFlP_uZdSYbXHcqC0F7rlIhJPINTps_tSVKlWvbS8Tq13BJW5FtLZcWl

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 49C7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
38ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlJNEmIwrThmsCuJD1gtk95RnGrYccrmTG79vHvrQjTlymf-Yw_hWqhC09oWmo
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 17-Aug-2021 18:57:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame B2EF 35 KB
13 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENTOMCqpvWjtxoQykGNEZDE&google_cver=1&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2s...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2slJU2KrKFZ7Psi4hkvAZyESxEZsnAoJc1zk2P5bGdBxlQ&google_hm=IGyJ...

170 B
188 B

38ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2slJU2KrKFZ7Psi4hkvAZyESxEZsnAoJc1zk2P5bGdBxlQ&google_hm=IGyJIrI7BZf9VaIshEcg-g

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJZllQaQ5dqUsWImlStk_ByKD5EO_0A7U8oM5WLlzISC2SSu8kS2slJU2KrKFZ7Psi4hkvAZyESxEZsnAoJc1zk2P5bGdBxlQ&google_hm=IGyJIrI7BZf9VaIshEcg-g
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKpXGbF...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKpXGbF...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NTAwMDAxNjE3NzU5Njg5Mw%3D%3D&google_push=AYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6...

170 B
188 B

39ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NTAwMDAxNjE3NzU5Njg5Mw%3D%3D&google_push=AYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6E9pVBCYNknvWEFzMpxGL1IsPeuEXfZ

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTA4MTcxNzU3NTAwMDAxNjE3NzU5Njg5Mw%3D%3D&google_push=AYg5qPKpXGbFhvvKxhiFSnRKBnxp89PxZr5r4FH2jWmxXaJnePHzsgzxB4vhhZRjukpdB6E9pVBCYNknvWEFzMpxGL1IsPeuEXfZ
pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 17 Aug 2021 17:57:50 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg
https://rtb.openx.net/sync/dds?google_gid=CAESEFHTW8ydbbfV_bjmL2C6jX0&google_cver=1&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Oh...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg&google_hm=xGro3b1uzMEzccykrMj-TQ==

170 B
188 B

48ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg&google_hm=xGro3b1uzMEzccykrMj-TQ==

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:48 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLE85YBjdojOljWeXzkKJEPknzB6yNNhZFvK_oyR7XJYPudLwISJ16HGKziVGWteJv_xl-aNOj-yWl1k6bvcA47QtjRI2-Ohg&google_hm=xGro3b1uzMEzccykrMj-TQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: abt14olf0kc3hlij6ci7992b9sqpt54n

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OmzDjhxoT-WSUb8iVdLnsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

42ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OmzDjhxoT-WSUb8iVdLnsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWh_IF3JmNJXoeUTkVgahSl8hyD-yIQwJUATQQ9bdkB4MJjbORHFSYF17LiS-sRBYa1rHXSk44MtKkR_8kC_BZ_Z80YS557Q

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=OmzDjhxoT-WSUb8iVdLnsg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWh_IF3JmNJXoeUTkVgahSl8hyD-yIQwJUATQQ9bdkB4MJjbORHFSYF17LiS-sRBYa1rHXSk44MtKkR_8kC_BZ_Z80YS557Q
date: Tue, 17 Aug 2021 17:57:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEEzwU4eGE8lYQRrAvVIQ1eA&google_cver=1&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjSh...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMWVMtMUYtREdURw==&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjShZUkuou-m62QlWcRXLiZu4iAkPtA

170 B
188 B

41ms
38ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMWVMtMUYtREdURw==&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjShZUkuou-m62QlWcRXLiZu4iAkPtA

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1NHRENMWVMtMUYtREdURw==&google_push=AYg5qPJfGTE10M6o4Q9Ucyaj1oClLIcxxuSydle7uXHRdRwBG48WOm09DpAfIkBprFhGHkivjShZUkuou-m62QlWcRXLiZu4iAkPtA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame D16B
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame D16B 43 B
296 B 24ms
20ms Image
image/gif 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEE2bUQsU7lcIWEDBPATDiDs&google_cver=1&google_push=AYg5qPJ3yAUKiFP-HaEQxdcdUBcGlm_4LavNAeriRlDqXb5nfJHG0q_JUzWNaeFsxhZRg-cI7aKmmznpDGMoNUp90lnALKCe_c_-
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=429&slotname=7423846064&adk=1226367171&adf=3037871778&pi=t.ma~as.7423846064&w=611&lmt=1629223067&rafmt=11&psa=0&format=611x429&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067505&bpp=2&bdt=1561&idt=2&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600%2C300x600%2C640x164&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=329&ady=3346&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7ClEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=18&uci=a!i&btvi=5&fsb=1&xpc=Dl7vqdIZPG&p=http%3A//zaytung.com&dtd=19
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:8678:af0d:fda8:5a84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame D16B 0
12 B 40ms
37ms Image
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IxUMnN28nIi04NBsqH1R7I7c820qBgDoK8WTlVBKWzGgJD20BamdCLxHhfZ_wdWJAu8MYY

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK moment~timeline.6955291becca2212c21a83a5b7ccff16.js Show response
platform.twitter.com/js/ 25 KB
8 KB 7ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline.6955291becca2212c21a83a5b7ccff16.js
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: 0da8b681b5b73ff645ff5d1312a7a6e7db5f568d6ee68ad10ce77b142d5b7735

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:33:40 GMT
Server: ECS (frb/674C)
Age: 701973
Etag: "6a28849a29acd0e1df291c75b82e9101+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 8015

GET
H/1.1 200
OK timeline.f0018d9150722c67abdd0e6bbab13587.js Show response
platform.twitter.com/js/ 20 KB
7 KB 15ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.f0018d9150722c67abdd0e6bbab13587.js
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6763) /
Resource Hash: 964794272aa168ce3feac3a84460c1beb01606da0e303689b8aee75fb354117d

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:33:40 GMT
Server: ECS (frb/6763)
Age: 701973
Etag: "b6a9074027bd2a446a397ba65736afc5+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 6444

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame DF13 70 B
265 B 256ms
37ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?gdpr=1&ttd_pid=054f32o&us_privacy=1---&ttd_tpi=1
Requested by: Host: imprammp.taboola.com
URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: http://imprammp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 sync
taboola-supply-partners.tremorhub.com/ Frame DF13 43 B
183 B 289ms
95ms Image
image/gif 2600:1f18:612b:4264:c62f:533:271f:3e7e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://taboola-supply-partners.tremorhub.com/sync?UISTB=%3CtaboolaUserId%3E&gdpr=1&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Ftelaria-rtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D1%26us_privacy%3D1---%26taboola_hm%3D%5BTVUSER_ID%5D%26orig%3Dvideo
Requested by: Host: imprammp.taboola.com
URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c62f:533:271f:3e7e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: http://imprammp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2

200

rtb-h Show response
sync-t1.taboola.com/sg/spotx-rtb-network/1/ Frame DF13
Redirect Chain

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3D...
https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3D...
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

0
229 B

35ms
32ms

Script
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Requested by: Host: imprammp.taboola.com
URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://imprammp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 12559

Redirect headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Server: nginx
Location: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 124
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame DF13 43 B
145 B 1873ms
35ms Image
image/gif 3.127.7.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?gdpr=1&us_privacy=1---&ssp=taboola
Requested by: Host: imprammp.taboola.com
URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.7.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-7-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: http://imprammp.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame D881 35 KB
13 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4285561087574024&output=html&h=600&slotname=3506478908&adk=2527040315&adf=297527732&pi=t.ma~as.3506478908&w=300&lmt=1629223067&psa=0&format=300x600&url=http%3A%2F%2Fzaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&flash=0&wgl=1&dt=1629223067252&bpp=1&bdt=1308&idt=1&shv=r20210812&mjsv=m202108100101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Ded47df7372cac525-2293584cadc90051%3AT%3D1629223066%3ART%3D1629223066%3AS%3DALNI_MZQblCqaoaipv8OwPY6hgQHzDBz0Q&prev_fmts=0x0%2C160x600%2C970x250%2C300x250%2C300x600&nras=1&correlator=1884844164231&frm=20&pv=1&ga_vid=648631566.1629223066&ga_sid=1629223066&ga_hid=106732675&ga_fc=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=984&ady=4782&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747620%2C182982100%2C20211866%2C31062297%2C31062165&oid=3&psts=AGkb-H8p8RrjkJ8_RAKmRb8CTENCwpzp6f1rq9egFyJ071DrEw5y1vopvs1MC0pI5yjYh0nYWoNGLgDDjkm1&pvsid=790460311999216&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=16&uci=a!g&btvi=3&fsb=1&xpc=pEXtmsOjlg&p=http%3A//zaytung.com&dtd=10

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H3-29 200 page.php Show response
www.facebook.com/v2.2/plugins/ Frame 6907 62 KB
19 KB 62ms
62ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bae860e25ca7e4c49a479311492df1bcb2bb85a9cf7aac452b6616859f139655

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
facebook-api-version: v4.0
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: uK+3Xv8lQJ0PsyeX4dlyNNm6vI4l2zJJbDpgak1QlkY6GDuR7UNIOVF7Ha+RL14IkKj2fCV51FX622y2a5LPNA==
date: Tue, 17 Aug 2021 17:57:49 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29 200 like.php Show response
www.facebook.com/v2.2/plugins/ Frame B83E 0
21 B 29ms
28ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df26f7f61f1996a%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/like.php?action=like&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df26f7f61f1996a%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.zaytung.com%2Ffotohaberdetay.asp%3Fnewsid%3D395636&layout=standard&locale=tr_TR&sdk=joey&share=false&show_faces=false
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: k0dN2XsKqJusJpO1rKK3O0pgoEEw2d+aDMdUiTjsx3PRb5y7DD7XPur8cqFF5D0NeQ6y9hR+RTs2iEvz6kx1Iw==
content-length: 0
date: Tue, 17 Aug 2021 17:57:49 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29 200 comments.php
www.facebook.com/v2.2/plugins/ Frame 9D28 0
0 30ms
29ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df18082e52b4fafc%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=0&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js?hash=754ab8053e08918f9db1765003cbf34f

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.2/plugins/comments.php?app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df18082e52b4fafc%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&color_scheme=light&container_width=0&height=100&href=http%3A%2F%2Fwww.zaytung.com%2Fhaberdetay.asp%3Fnewsid%3D395636&locale=tr_TR&numposts=5&sdk=joey&version=v2.2&width=500
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: q1ZNaJ6Ipl93c9z5qzPNWQkIgqiOqOftviYZ5xjQPAQkX48Q3PRBqcUakI54D9rWGAd4lCIdKkfHd311AflPZQ==
content-length: 0
date: Tue, 17 Aug 2021 17:57:49 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0EA7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

47ms
47ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUlJNEmIwrThmsCuJD1gtk95RnGrYccrmTG79vHvrQjTlymf-Yw_hWqhC09oWmo
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 17-Aug-2021 18:57:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 17 Aug 2021 17:57:49 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F4C 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 81AF 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8247
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame A4B4 70 B
264 B 113ms
37ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?gdpr=1&ttd_pid=054f32o&us_privacy=1---&ttd_tpi=1
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 sync
taboola-supply-partners.tremorhub.com/ Frame A4B4 43 B
182 B 146ms
96ms Image
image/gif 2600:1f18:612b:4264:c62f:533:271f:3e7e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://taboola-supply-partners.tremorhub.com/sync?UISTB=%3CtaboolaUserId%3E&gdpr=1&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Ftelaria-rtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D1%26us_privacy%3D1---%26taboola_hm%3D%5BTVUSER_ID%5D%26orig%3Dvideo
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c62f:533:271f:3e7e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2

200

rtb-h Show response
sync-t1.taboola.com/sg/spotx-rtb-network/1/ Frame A4B4
Redirect Chain

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3D...
https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3D...
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

0
230 B

32ms
31ms

Script
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 12559

Redirect headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Server: nginx
Location: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 40
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame A4B4 43 B
146 B 1729ms
35ms Image
image/gif 3.127.7.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?gdpr=1&us_privacy=1---&ssp=taboola
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.7.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-7-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H/1.1 200
OK f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 254 B
1 KB 61ms
38ms Image
image/png 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
Via: 1.1 varnish
ETag: "dfa7b52c86e56bd67fa4002f6ed19854"
Age: 8401
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 254
x-amz-id-2: mouaSx+zLz+daByqFPTyWftjEEWVx2Ra4QTNy9MPIUClTT4jaqZDUS1ZHFYvQA07FPAY+M6uW30=
X-Served-By: cache-fra19160-FRA
Last-Modified: Wed, 24 Jun 2015 07:14:11 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
X-Timer: S1629223070.580518,VS0,VE0
Date: Tue, 17 Aug 2021 17:57:49 GMT
x-amz-request-id: 6P8Y14FA9N2SAAH6
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
Content-Type: image/png
abp: 57
X-Cache-Hits: 4867

GET
BLOB 206
Partial Content 82a15a6f-9078-43d6-a81b-b98750d97b69
http://zaytung.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://zaytung.com/82a15a6f-9078-43d6-a81b-b98750d97b69
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
BLOB 206
Partial Content eb458929-f32f-4ceb-b683-695ff30aeaca
http://zaytung.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:http://zaytung.com/eb458929-f32f-4ceb-b683-695ff30aeaca
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
H/1.1 206
Partial Content xbc0aloqhmud67pbbr8l.mp4
c3.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1626181470/ 506 KB
506 KB 1085ms
38ms Media
video/mp4 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://c3.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1626181470/xbc0aloqhmud67pbbr8l.mp4
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 32672ef61f5b9b70b7bed6b78696b9cecd6fa760f3afd89dcc0ce7da854951c4

Request headers

Referer: http://zaytung.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: olkZIK0FrgdVObCqqxukl0NQ59tHhRcG
Via: 1.1 varnish
ETag: "aaf260cd678651116da4f9adf3d7dc58"
Age: 1
X-Cache: HIT
Content-Range: bytes 0-517718/517719
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 517719
x-amz-id-2: 9o9RQvu1OuCqt+O7G4p3M7tgxdz5CVU+eUZ+mJWMBJRq7MfdTGjUYOEVgxfc7TVN0v+Q5K8Qc2c=
X-Served-By: cache-fra19140-FRA
Last-Modified: Tue, 13 Jul 2021 13:06:14 GMT
Server: AmazonS3
X-Timer: S1629223071.676035,VS0,VE1
Date: Tue, 17 Aug 2021 17:57:50 GMT
x-amz-request-id: V8CKKJHTKFD46YPK
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
Content-Type: video/mp4;codecs=avc1
abp: 57
X-Cache-Hits: 0

GET
H/1.1 200
OK content14_10_18m.js Show response
vidstat.taboola.com/ 37 KB
8 KB 56ms
37ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/content14_10_18m.js
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/30_0_2/infra/cmTagWIDGET_ITEM.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ab8bbbaf028510d8b119cce741f0c2cc94816dcc113d83cac81a6aade6a76fa9

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 78059242182c195ff7f26013772da09a.cloudfront.net (CloudFront), 1.1 varnish
Age: 3746481
X-Cache: Hit from cloudfront, HIT
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 7638
X-Served-By: cache-fra19121-FRA
Last-Modified: Sun, 14 Oct 2018 13:31:31 GMT
Server: AmazonS3
X-Timer: S1629223070.772454,VS0,VE0
ETag: "d8d81221ec6e604811ce469d899c9c8b"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA6-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 66yyU3j4fvwR2pWghuTSRe4J90AY-n2Za3iK1pdjZQmlD5ieLGYAOA==
X-Cache-Hits: 993009

GET
H/1.1 200
OK OvaMediaPlayer.js Show response
vidstat.taboola.com/vpaid/vPlayer/player/v12.6.3/ 567 KB
147 KB 56ms
38ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://vidstat.taboola.com/vpaid/vPlayer/player/v12.6.3/OvaMediaPlayer.js
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/30_0_2/infra/cmTagWIDGET_ITEM.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e95623e9082ef2c44c96252359f39cd05a5b21f5155f025a493244d5f7b40357

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:49 GMT
Via: 1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront), 1.1 varnish
Age: 118554
x-amz-meta-mtime: 1629104445
X-Cache: Hit from cloudfront, HIT
x-amz-meta-ctime: 1629104445
x-amz-meta-mode: 33188
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 149596
X-Served-By: cache-fra19129-FRA
Last-Modified: Mon, 16 Aug 2021 09:00:46 GMT
Server: AmazonS3
X-Timer: S1629223070.796420,VS0,VE0
ETag: "b9458d021b5d5c8db3cb1ca735d691bd"
x-amz-meta-uid: 0
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
x-amz-meta-gid: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=2592000
X-Amz-Cf-Pop: FRA2-C1
Accept-Ranges: bytes
Content-Type: application/javascript
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 7O3DdMBFnvgUuaflMY58zeYKp_EBqw2urDEKP9z0EuI7Pa-qmQ0-rw==
X-Cache-Hits: 18943

GET
H2 200 sync Show response
am-match.taboola.com/ Frame 4BD8 1 KB
1 KB 33ms
33ms Document
text/html 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/units/30_0_2/infra/cmTagWIDGET_ITEM.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 86d0b0c5c5ac215d1bccc0057a9e5aeaf96554438e7eacc1c8d53f9f3f827b26

Request headers

:method: GET
:authority: am-match.taboola.com
:scheme: https
:path: /sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

server: nginx
date: Tue, 17 Aug 2021 17:57:49 GMT
content-type: text/html;charset=ISO-8859-1
machineid: 3403

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 126 KB
9 KB 48ms
25ms Script
application/javascript 2606:2800:134:1a0d:1429:742:782:b6
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_zaytung_old&dnt=false&domain=zaytung.com&lang=tr&screen_name=zaytung&suppress_response_codes=true&t=1810247&tz=GMT%2B0200&with_replies=false

Requested by

Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D26) /

Resource Hash

68534908a6bef9d16a393b51e34adb313cb0ca3a53f8b213915c213f662f29b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80
x-cache: HIT
content-disposition: attachment; filename=jsonp.jsonp
access-control-allow-methods: GET
vary: Accept-Encoding
content-length: 8448
x-xss-protection: 0
last-modified: Tue, 17 Aug 2021 17:56:29 GMT
server: ECS (lcy/1D26)
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: application/javascript;charset=utf-8
expires: Tue, 17 Aug 2021 18:02:49 GMT
cache-control: must-revalidate, max-age=300
x-connection-hash: 5f36e208f56c143efc9df1ea7403e8de95723393ab8ac3717331bdc1a731b24d
accept-ranges: bytes
timing-allow-origin: *
x-transaction: ae89795e461b0913
access-contol-allow-origin: platform.twitter.com

GET
H3-29 200 7expTFhmPeK.css
static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/ Frame 6907 18 KB
5 KB 8ms
6ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

11f42ca857ce06541d88c7bb60a1d098fb97578ad43f919b1995e05b9f9f62a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: N1NdDz155En/AvJohkVraQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4757
x-fb-rlafr: 0
x-fb-debug: nMXNWDTX8v0onY3gZsdZcVq3KqppNnKeS9WLacPljzM8PktwU+0QZWpgh801WXaVUOt8/X/vn+rR3q5/xNZTNg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 16 Aug 2022 17:55:20 GMT

GET
H3-29 200 5Fsnp3irenq.css
static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/ Frame 6907 2 KB
870 B 13ms
11ms Stylesheet
text/css 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/5Fsnp3irenq.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ec98f88129d5c3180c878d70ae27ffcdf7907737e4d2e82ec41b6f81fe1cd8ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: J9gtDCcpBAeYh1TcXJ9kqQ==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob:;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 816
x-fb-rlafr: 0
x-fb-debug: pC1FFKhmMkrA19EI4UWYczTZariSdW6kV3LB2T6O/KvqH8vOgypoajS/OFS0SalhsC1hzro9e+CJXac40319Vg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:16:17 GMT

GET
H3-29 200 J72p10TEgyp.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ Frame 6907 299 KB
81 KB 13ms
11ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a1cc391d239011cc8f279135cd083054a901bac123c53d2640a630f938b3cf88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: TU/3nWX5Xkg0DMA6F+ZmpA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 83021
x-fb-rlafr: 0
x-fb-debug: 5XEukMXYMnOm4wIYxFyi0LOehLBsUA9QgSMF98GLnr4F7blC5sUoVVVG+X9hUCNRmxGG/YT3O5P1l8bdIUOxbg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 16 Aug 2022 21:21:10 GMT

GET
H3-29 200 n3M57Te-s_v.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yQ/r/ Frame 6907 6 KB
2 KB 15ms
13ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/n3M57Te-s_v.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3c50badce7cb97142e754e7c20a9012835a5b7ebec352d6b8cc63599b762b15b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: e9cyV2oOQCHCcOTmXPNOuA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1816
x-fb-rlafr: 0
x-fb-debug: Vl9Ha8ocoQ4Q/x62p/GC3ej98eYOp2Wdo47vQaC0uio69w7p//bJEngZqQQW+I0U9L6J2AFdmKLKPWNPCZOxAw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 04:31:34 GMT

GET
H3-29 200 WG-Y1Lnd0i4.js Show response
static.xx.fbcdn.net/rsrc.php/v3/ya/r/ Frame 6907 62 KB
19 KB 15ms
13ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/WG-Y1Lnd0i4.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e06a4b89626ecf28bff1ba772e85c78b9365e16a7a536e8904f6b5153e952532

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: ho7GiWqLFKNKY7yKyRr4Lw==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 19481
x-fb-rlafr: 0
x-fb-debug: z9SbWro3mw7zJQ1z6dLpLSQHCxJ3bRGuIHgzCah/yI+OQyf9Lydj6EPH+Wcr4Ww8svQvfVOsQIEvOYAPvdqzhA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 18:14:25 GMT

GET
H3-29 200 LbmZCDFNYok.js Show response
static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/ Frame 6907 130 KB
36 KB 16ms
14ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

022faf125f122d1c715d2c7d3bc274b0adcf8c394a08972057c2078b1f853ff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: /QE2nMkhHBFmtdKo2kfA7Q==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 36817
x-fb-rlafr: 0
x-fb-debug: xaKLecghGSC6TIQ5e4BGO2YbCF9w6uAI2+Nm5ZJPAhrBV881WBP7cy1wWSmOg94iESXB0iQbgnHTBnUbN2iVcw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 00:43:13 GMT

GET
H3-29 200 g8k43lnQ7E5.js Show response
static.xx.fbcdn.net/rsrc.php/v3iUz84/yP/l/tr_TR/ Frame 6907 16 KB
5 KB 17ms
15ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iUz84/yP/l/tr_TR/g8k43lnQ7E5.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d5decaef1cf2a7030d58e9689486f8cbf049fc0d89ac12f3729743e5cedda6f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: LbZJL8AxxZnX1W8kMz8PGA==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob:;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 5245
x-fb-rlafr: 0
x-fb-debug: QObAn4NsRpx38NAaHpPe9I9TsFQudn1DSwS2cCqQHRx4/k8XZj16YpPK/IrC+LRQ2mymsoNMITS6MNC5ocGctQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:33:01 GMT

GET
H3-29 200 D6mOXAYkkis.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yN/r/ Frame 6907 10 KB
3 KB 17ms
15ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yN/r/D6mOXAYkkis.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e460d2f4a4bcd89ee69788e97a770479f30c11442ae94430ecc83ae2d60fb13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: tQHB9ZPry3nO9pgn7cwAeQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3457
x-fb-rlafr: 0
x-fb-debug: X49RgTC3YhLeN+1UUU8vaI/K6sj7dZFU88K3s/XMOdJgJbnozY6E9XgLlUanHlssZmShQXWxEiuxB9rqXgHaGw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 00:20:44 GMT

GET
H3-29 200 I6bbPmJMDVr.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yx/r/ Frame 6907 153 KB
45 KB 17ms
15ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/I6bbPmJMDVr.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

26f9321adbb48980c48e7614fc682581346172514dc2786be1bafb5007197037

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 3Pny8oKYJoOSaNhUqmBGgA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 46182
x-fb-rlafr: 0
x-fb-debug: Y7J+M4SKEXIN+dob5dSIXBPHEsWmEbB1Y1CJZ0gLjz7KSGWo4QtnQpDU78FULcg7zqf3nb+ocUEjuO5PIJKIUA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 13 Aug 2022 01:22:45 GMT

GET
H3-29 200 yousnbRo0-R.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ Frame 6907 9 KB
2 KB 17ms
16ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/yousnbRo0-R.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5737cf798d4dda6b0a9f7119f4ed472213769167acd13a235fb920917bde817d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: bW9vsHXH9YkbbtG1+bEHQw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2502
x-fb-rlafr: 0
x-fb-debug: f/p5G1mJjJ0e2fZu0MNICGZE7FCFZj2IQi7Rhlqr9+ychHqKb0/CMa+/nsjLpEoPRb0vMOb22HnQhHGDGk5NZA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 02:16:29 GMT

GET
H3-29 200 Vw4y57TdJLk.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yh/r/ Frame 6907 4 KB
2 KB 17ms
16ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/Vw4y57TdJLk.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

63120ebeacf1997f60bc2a926346877a23143dca8611ef1a2a31b56a1649716c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 17wndI7E+/3TvkYvKn8UzA==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1596
x-fb-rlafr: 0
x-fb-debug: 8VCrBXfLDoR1VnHy+uXYiIkMIMptOW6J7EhT8qWOSLR4LWYmpLGr5XCRBf2SBl5wnDm+7U0gGpJNfXCrJik3FA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 06:44:38 GMT

GET
H3-29 200 oojX0gHvjt8.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y7/r/ Frame 6907 1 KB
510 B 17ms
17ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y7/r/oojX0gHvjt8.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

91138c41961a35d849d3cfe00ed582a61a80a2ae33b0f9d5bc0a4eabf98c6127

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: WjCQ32aON6IudKuf3ZqGhg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 457
x-fb-rlafr: 0
x-fb-debug: b4SS1x+hYrYoe7UFppTTnW1elcYCgS2fH+/RFstFhdytva34i9T0HS8Q5kNKRBQ83hY5Hc2uLAnPXFaHnk2XqQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Mon, 15 Aug 2022 16:54:14 GMT

GET
H2 200 10659284_688722784541478_1113697741096065586_n.jpg
scontent.xx.fbcdn.net/v/t1.18169-9/p118x118/ Frame 6907 13 KB
13 KB 8ms
6ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t1.18169-9/p118x118/10659284_688722784541478_1113697741096065586_n.jpg?_nc_cat=105&ccb=1-5&_nc_sid=dd9801&_nc_ohc=JjJPX7hZd1wAX8u6Zhh&_nc_ht=scontent.xx&edm=AGrQwCAEAAAA&oh=9a2dc8bb10eb2a49e50251a58429157d&oe=61425624
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 7ffd27c128c00e42048c9df292d008e7782f087d9ab966183695eb108915c6e8

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 1728454570
date: Tue, 17 Aug 2021 17:57:50 GMT
x-fb-trip-id: 686109401
last-modified: Fri, 12 Sep 2014 12:28:36 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1249673849
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 12847

GET
H2 200 903208_451494281597664_2139334139_o.jpg
scontent.xx.fbcdn.net/v/t31.18172-1/cp0/c10.0.50.50a/p50x50/ Frame 6907 1 KB
1 KB 8ms
7ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t31.18172-1/cp0/c10.0.50.50a/p50x50/903208_451494281597664_2139334139_o.jpg?_nc_cat=111&ccb=1-5&_nc_sid=dbb9e7&_nc_ohc=IbHjY6QZIngAX_x2eE8&_nc_ht=scontent.xx&edm=AGrQwCAEAAAA&oh=6ebf2b5ed42de0429f8e72871e9e8597&oe=61414F8C
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 73f955332cf5acaffdd8f2e8fdafa3369fc72002ad7686a95a96fee4eb51a291

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 1425013494
date: Tue, 17 Aug 2021 17:57:50 GMT
x-fb-trip-id: 686109401
last-modified: Mon, 22 Apr 2013 14:40:32 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1420095690
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1119

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 8B2A 0
239 B 46ms
31ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=16698
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/gif

GET
H2

200

/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 8B2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEB2ambZMb5A26XnNuS2njyk&google_cver=1

0
187 B

42ms
42ms

Image
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEB2ambZMb5A26XnNuS2njyk&google_cver=1
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Tue, 17 Aug 2021 17:57:50 GMT
via: 1.1 varnish
server: nginx
x-timer: S1629223070.166275,VS0,VE9
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-fra19148-FRA

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEB2ambZMb5A26XnNuS2njyk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 304
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 8B2A 42 B
411 B 39ms
27ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b:$UID
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:687
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B2A
Redirect Chain

https://sync.taboola.com/sg/google-network/1/rtb?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e

170 B
188 B

45ms
44ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e
date: Tue, 17 Aug 2021 17:57:50 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 12549

GET
H2

200

/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 8B2A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=b65c7689-8ac6-4af8-a6db-ad11e3b91be1

0
54 B

43ms
40ms

Image
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=b65c7689-8ac6-4af8-a6db-ad11e3b91be1
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Tue, 17 Aug 2021 17:57:50 GMT
via: 1.1 varnish
server: nginx
x-timer: S1629223070.265291,VS0,VE9
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-fra19148-FRA

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=b65c7689-8ac6-4af8-a6db-ad11e3b91be1
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 239

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame 8B2A
Redirect Chain

https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent=&dnr=1

0
433 B

51ms
43ms

Image
text/plain

216.52.2.19
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:50 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap4ams1
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:50 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ce.lijit.com/merge?pid=42&3pid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap4ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2 200 rtset
bh.contextweb.com/bh/ Frame 8B2A 49 B
406 B 316ms
101ms Image
image/gif 198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
content-language: en-US
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
content-type: image/gif;charset=iso-8859-1
cw-server: bh-deployment-84459f4bbf-z5c8w
expires: -1

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 8B2A 43 B
697 B 124ms
36ms Image
image/gif 185.86.137.132
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=107&partneruserid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=0&gdpr_consent=
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.132 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:49 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2 204 put
e1.emxdgt.com/ Frame 8B2A 0
59 B 1222ms
35ms Image
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d41&uid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
content-length: 0
content-type: text/html

GET
H2

200

/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 8B2A
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=77701eb7-2dfa-42ac-b72c-fe23ee93e4bb

0
229 B

32ms
32ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=77701eb7-2dfa-42ac-b72c-fe23ee93e4bb
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 15320

Redirect headers

pragma: no-cache
x-errorlevel: 0
server: Microsoft-IIS/10.0
date: Tue, 17 Aug 2021 17:57:49 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=77701eb7-2dfa-42ac-b72c-fe23ee93e4bb
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3208
content-type: text/html; charset=utf-8
content-length: 222
expires: Tue, 17 Aug 2021 00:00:00 GMT

GET
H/1.1

200

2.gif
id5-sync.com/c/464/441/6/ Frame 8B2A
Redirect Chain

https://id5-sync.com/s/464/9.gif?puid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
https://id5-sync.com/c/464/464/7/1.gif?puid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=1&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F6%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D1%26gdpr_consent%3D&gdpr=1&gdpr_consent=
https://id5-sync.com/c/464/441/6/2.gif?puid=e_d19142b4-d46e-463c-b5cd-9fdd5374776a&gdpr=1&gdpr_consent=

43 B
1 KB

32ms
32ms

Image
image/gif

51.89.7.198
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/c/464/441/6/2.gif?puid=e_d19142b4-d46e-463c-b5cd-9fdd5374776a&gdpr=1&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.7.198 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p20.id5-sync.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Transfer-Encoding: chunked
Content-Type: image/gif;charset=UTF-8
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

Redirect headers

location: https://id5-sync.com/c/464/441/6/2.gif?puid=e_d19142b4-d46e-463c-b5cd-9fdd5374776a&gdpr=1&gdpr_consent=
date: Tue, 17 Aug 2021 17:57:51 GMT
p3p: CP="This is not a P3P policy"
server: nginx
timing-allow-origin: *
content-length: 0
content-language: en-US

GET
H2

200

rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 8B2A
Redirect Chain

https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=taboola&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=taboola
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=taboola
https://x.bidswitch.net/sync?dsp_id=70&user_id=3554357157478683836&ssp=taboola
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=3554357157478683836&ssp=taboola
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=0a1721d8-e912-4c1e-8f1f-8e3ebc7c2042

0
230 B

32ms
32ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=0a1721d8-e912-4c1e-8f1f-8e3ebc7c2042
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 18287

Redirect headers

location: //sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=0a1721d8-e912-4c1e-8f1f-8e3ebc7c2042
date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 8B2A
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=taboola
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b&tbid=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e&query=taboola_hm%3Df6121a1b-437c-...

0
76 B

39ms
37ms

Image
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b&tbid=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e&query=taboola_hm%3Df6121a1b-437c-4df8-82b7-4350a0b4082b&isDirect=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
via: 1.1 varnish
server: nginx
x-timer: S1629223071.365472,VS0,VE9
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-fra19148-FRA

Redirect headers

location: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=f6121a1b-437c-4df8-82b7-4350a0b4082b&tbid=3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e&query=taboola_hm%3Df6121a1b-437c-4df8-82b7-4350a0b4082b&isDirect=0
date: Tue, 17 Aug 2021 17:57:51 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 19110

GET
H2 200 sd
u.openx.net/w/1.0/ Frame 8B2A 43 B
106 B 32ms
30ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/sd?id=543998486&val=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&gdpr=0&gdpr_consent=
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.214.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
via: 1.1 google
server: OXGW/16.214.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 101956
jadserve.postrelease.com/suid/ Frame 8B2A 43 B
428 B 310ms
99ms Image
image/gif 75.101.244.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101956?ntv_r=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fnativortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3DNTV_USER_ID
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.244.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-244-20.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 8B2A
Redirect Chain

https://eb2.3lift.com/xuid?mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla
https://eb2.3lift.com/xuid?ld=1&mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

45ms
43ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla&gdpr=1&cmp_cs=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7772&xuid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&dongle=tbla&gdpr=1&cmp_cs=&us_privacy=
date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ 2 KB
1 KB 43ms
28ms Script
application/javascript 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210817-13-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7faef21187e15aefd3d8a5a585ca32c66358f597a97f5abd276517eaea1057d3

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: iYtYacMlAb7PnD4NbVgysKvLj2fov4iK
content-encoding: gzip
etag: "3aa74dbf5cd656dbb65deda2d238ddbd"
age: 1430
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 911
x-amz-id-2: qQheTKeQES6bMdCZ/EuMmRskbiEN65W4DOuEKpUxChRbjEcyJKpTEG2fJKFHmn2GKELuYHBGLWM=
x-served-by: cache-fra19148-FRA
last-modified: Wed, 14 Jul 2021 05:06:01 GMT
server: AmazonS3
x-timer: S1629223070.076428,VS0,VE0
date: Tue, 17 Aug 2021 17:57:50 GMT
vary: Accept-Encoding
x-amz-request-id: X0T5G34XC8D2QGE8
via: 1.1 varnish
cache-control: private, max-age=3600
accept-ranges: bytes
content-type: application/javascript
abp: 41
x-cache-hits: 238675

GET
H/1.1 200
OK timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
platform.twitter.com/css/ Frame C25D 53 KB
12 KB 7ms
6ms Stylesheet
text/css 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/673A) /
Resource Hash: 8a322ede0b619b9051fccbe2a1a31f402f416d45f92c245aafcbe75e42f6f2b2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:33:36 GMT
Server: ECS (frb/673A)
Age: 701973
Etag: "fb5a989a2b36d6be5344baad6a1936fd+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: text/css; charset=utf-8
Content-Length: 12144

GET
H/1.1 200
OK timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
platform.twitter.com/css/ 53 KB
53 KB 14ms
6ms Image
text/css 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/673A) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 02 Aug 2021 20:33:36 GMT
Server: ECS (frb/673A)
Age: 701973
Etag: "fb5a989a2b36d6be5344baad6a1936fd+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: text/css; charset=utf-8
Content-Length: 12144

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 8B1A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

281 B
554 B

116ms
29ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Requested by: Host: imprammp.taboola.com
URL: http://imprammp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66243815&crid=5333395&dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&cmcv=&pix=undefined&cb=1629223069096&uv=3002&tms=1629223069096&abt=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm&ft=0&unm=WIDGET_ITEM&aure=false&agl=1&cirid=BA2D6F88A0577711812108090799&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://imprammp.taboola.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://imprammp.taboola.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 4BD8 70 B
264 B 40ms
37ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?gdpr=1&ttd_pid=054f32o&us_privacy=1---&ttd_tpi=1
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 sync
taboola-supply-partners.tremorhub.com/ Frame 4BD8 43 B
182 B 97ms
94ms Image
image/gif 2600:1f18:612b:4264:c62f:533:271f:3e7e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://taboola-supply-partners.tremorhub.com/sync?UISTB=%3CtaboolaUserId%3E&gdpr=1&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Ftelaria-rtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D1%26us_privacy%3D1---%26taboola_hm%3D%5BTVUSER_ID%5D%26orig%3Dvideo
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c62f:533:271f:3e7e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2

200

rtb-h Show response
sync-t1.taboola.com/sg/spotx-rtb-network/1/ Frame 4BD8
Redirect Chain

https://sync.search.spotxchange.com/partner?gdpr=1&adv_id=8532&us_privacy=1---&redir=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fspotx-rtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%24SPOTX_USER_ID%26orig%3D...
https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&

0
229 B

33ms
32ms

Script
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 20048

Redirect headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Server: nginx
Location: https://sync-t1.taboola.com/sg/spotx-rtb-network/1/rtb-h?taboola_hm=a2d23572-ff84-11eb-898c-124172220306&orig=video&us_privacy=1---gdpr=1&
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 130
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 4BD8 43 B
145 B 1077ms
36ms Image
image/gif 3.127.7.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?gdpr=1&us_privacy=1---&ssp=taboola
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.7.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-7-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://am-match.taboola.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame BC4D
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

281 B
554 B

117ms
28ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://am-match.taboola.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://am-match.taboola.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H3-29 200 mOcgOmDDSbN.png
static.xx.fbcdn.net/rsrc.php/v3/yL/r/ Frame 6907 1 KB
1 KB 13ms
11ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/mOcgOmDDSbN.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3dc936b3c6e476fbbbfea1c5d962f4bee0e3636450608357ffcf9e6e92e0d596

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: EQW5xbTH+4NHoekjAPZYMQ5L5d3NAs1wVKX1iTT/6yW+tg1BSdq+eO3aguaiTeLoU+ydP727hz0rNkF+Pf8TSg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 2bKr5oI1XogALo4o3p6kDA==
date: Tue, 17 Aug 2021 17:57:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1193
x-fb-rlafr: 0
expires: Wed, 10 Aug 2022 15:47:41 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ Frame C979 0
459 B 51ms
39ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bldnkm_gbYYCWB5vHx_APnZGv6AEAAAAAOAHgBAI&bg=!Y2ClYCTNAAZvV8FTb1c7ACkAdvg8WjPJjq4IayaNcXar7bEo2mZx5JV0uHFga88r59FGBp6AkZxqJgIAAAQgUgAAAIJoAQeZAnVP7SpxWD1ShnXamxSfL6SubL4NhB-0X-jI9ee2vYDJLNQ1qBEV0zR7WjTrTM6kAnYD91w_Zjs1nobNwJH1effy7eQHAAsw1ol9DuLOPtX2_Cp1USk-3fgT4T_iM3_309pqgTefKMUtsPLKx-xwWU0se1H8Aqgy3kY9C11UPnlQ-M1crNNww-PPRrjSwoxzKQKFUA7HmZ9T_5-vlxmLpp6b3LjgaeuwzOSYGafdWWM81Yfo5oR6oZ-oyWRW4NisTtuU71gg30tnlhzefokUdaRrB69hIaTE3oyQ7yxquBBtNWsmhrICpxKgdnax3EFiHY8wsA0CaWffyqjbS9kFSQlBsuArJgHf1pqxfrUbP3W_aFWCdzqze7-g_ak3nvO8D4_D3LBg9MhNcJ5O78v1Q4eRCkZ_xazkhNTs6ezs5MiILTUtBbrb-89ttvHaqUy6VQvZI5A1JQPGKP52W_bHP1GYL0L7z9cTVikDmWQVuZMk8uLgT2GLX5Ju82MC1t2Y3FSEvyWpRLQ3wkKRTTorZu4XrZAwqCyYWAdMCm0I7UVUh2nZTk17MwGwl9Tu6HjcIhj-bMBI2Yp39PiKvnYSru0LNLyL1IsQ1dtuNzTArfD3U-fVG9zheqIijJEK8ke-J4rxQh2tWa9hvYihIIaYwb_iE99HYZNgx858L2kYiQNRh0cF4Sx3kxfraK9u2xTuXu0md4PcsFNVQD6Iy_RNmKcrcAgapsBdRnMh-hebOp251gxDfKw3BdYkf-Zndv74WdBk90jXjyuWrRcWWjHNw0CvcFC5tHAmQKjMVhidQ1QWBlkht7z9FQLWkFrShsfVLcrKgCtTAw

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

HTTP/1.1

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:50 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mzl_xgidlclo_175x175-75_bigger_normal.jpg
pbs.twimg.com/profile_images/1267725076/ Frame C25D 7 KB
7 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1267725076/mzl_xgidlclo_175x175-75_bigger_normal.jpg

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D5) /

Resource Hash

8c187d19d10be09d0e9f14a381a4bb0607a6d9d64e6328d0fadf8e86602b49c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 23062
x-cache: HIT
content-length: 7190
surrogate-key: profile_images profile_images/bucket/5 profile_images/1267725076
last-modified: Thu, 04 Nov 2010 01:42:54 GMT
server: ECS (frb/67D5)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: b5a7eb23e5f0f646b3433f4e21d9d35903aa8e6e744fed88bb690e3d497200ad
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E9AppBOWUAEJEGI
pbs.twimg.com/media/ Frame C25D 13 KB
13 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E9AppBOWUAEJEGI?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D3) /

Resource Hash

43b1dd9e449104074001593ecda80f88dd71ec307c5fcd5fb63293aef3fe95e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 961
x-cache: HIT
content-length: 13126
surrogate-key: media media/bucket/3 media/1427686866556440577
last-modified: Tue, 17 Aug 2021 17:38:48 GMT
server: ECS (frb/67D3)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 4b97291e3a67fa7bf04db4e2cd838e9024914257dba96f345812d5e195053a11
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E87XCNQWUAYzruU
pbs.twimg.com/media/ Frame C25D 14 KB
14 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E87XCNQWUAYzruU?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6727) /

Resource Hash

8e8914ff64b4b1bb311544671f8f0308a882c35b2f3245d13c9b1d89c7f573e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 89674
x-cache: HIT
content-length: 13854
surrogate-key: media media/bucket/6 media/1427314564840968198
last-modified: Mon, 16 Aug 2021 16:59:25 GMT
server: ECS (frb/6727)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 0eb90d2d6501d7b227c5825632fe1ec40b97a044e1e695c9ae96ddda29744cfe
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E85HfY5WYAA2HpL
pbs.twimg.com/media/ Frame C25D 25 KB
25 KB 8ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E85HfY5WYAA2HpL?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67AA) /

Resource Hash

31bb34096bb35efc8f2de4de4a5c7514efafedda3afd4fe4995bbe8564da33ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 127404
x-cache: HIT
content-length: 25743
surrogate-key: media media/bucket/2 media/1427156736507535360
last-modified: Mon, 16 Aug 2021 06:32:15 GMT
server: ECS (frb/67AA)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 7dcc7d351514448b6315ac2caf2d03167d40b998d71be83714ca34cc7011a63e
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8syyXFXsAYh1rE
pbs.twimg.com/media/ Frame C25D 27 KB
27 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8syyXFXsAYh1rE?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/675D) /

Resource Hash

b27de2b4f36397e8236d04c8f2feda33efd9fdf023290d99a9f5c3f5d422166f

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 334143
x-cache: HIT
content-length: 27698
surrogate-key: media media/bucket/6 media/1426289547764281350
last-modified: Fri, 13 Aug 2021 21:06:22 GMT
server: ECS (frb/675D)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: b18c1f6a564acec39344381a5d692fb1cf7045cebe35b7f2eb0e3341344867ea
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8r7jdNWUAQT17W
pbs.twimg.com/media/ Frame C25D 23 KB
23 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8r7jdNWUAQT17W?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6738) /

Resource Hash

8464273a1f9feac060dd799a4a391b02ca745621afc1384f509cf298fa09ce67

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 348636
x-cache: HIT
content-length: 23284
surrogate-key: media media/bucket/3 media/1426228818570792964
last-modified: Fri, 13 Aug 2021 17:05:03 GMT
server: ECS (frb/6738)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3a297ea45c7ce6a57a5ca78a47ca2b732f0f8eb0282d727b68a7b2cdfbba271c
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8l1DcNXoAcmqip
pbs.twimg.com/media/ Frame C25D 66 KB
66 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8l1DcNXoAcmqip?format=jpg&name=small

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D3) /

Resource Hash

ef87b761b7a4de48c8956b8e748e049eeb420793a3886c1e22738cd09dc8eb68

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 451004
x-cache: HIT
content-length: 67191
surrogate-key: media media/bucket/0 media/1425799459011796999
last-modified: Thu, 12 Aug 2021 12:38:55 GMT
server: ECS (frb/67D3)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: e03a90d194ff363be674fc5817d1247234744d4a650aa07ba9b94060b2d3eae5
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8igmv5X0AQgum4
pbs.twimg.com/media/ Frame C25D 23 KB
23 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8igmv5X0AQgum4?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D5) /

Resource Hash

503fdac0a96979bca8369899030f3ec8c60d2b9fab161a70f4d9345f31adee60

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 506703
x-cache: HIT
content-length: 23348
surrogate-key: media media/bucket/1 media/1425565869615337476
last-modified: Wed, 11 Aug 2021 21:10:43 GMT
server: ECS (frb/67D5)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: f4e61ed844d585d5c0cd76faac3bb8ee30005feea273f53221dba2ea905a8b23
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8hEkI4XEAA032J
pbs.twimg.com/media/ Frame C25D 21 KB
22 KB 8ms
7ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8hEkI4XEAA032J?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/674C) /

Resource Hash

20c606ca6dc060b2b665a33b9421aff93531a5290186538bd8e633f114de1b7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 530828
x-cache: HIT
content-length: 22002
surrogate-key: media media/bucket/2 media/1425464669712617472
last-modified: Wed, 11 Aug 2021 14:28:35 GMT
server: ECS (frb/674C)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 147195f14a4c314026992ed10540e60545f3a7821ae619b90053a522cc310538
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8aJEYlXMBUZjr0
pbs.twimg.com/media/ Frame C25D 19 KB
19 KB 7ms
7ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8aJEYlXMBUZjr0?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/674D) /

Resource Hash

f493ad8a0161ca8b8f7b1d981c2cecbc1888d40624cec4b650921fdb8608e1b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 42282
x-cache: HIT
content-length: 19623
surrogate-key: media media/bucket/4 media/1424977040520982549
last-modified: Tue, 10 Aug 2021 06:10:55 GMT
server: ECS (frb/674D)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3698736f1b96c691059060efa23138a672cb8bff992e163b1721165d420723a3
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8X-h3yWYAA6LzF
pbs.twimg.com/media/ Frame C25D 21 KB
21 KB 12ms
0ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8X-h3yWYAA6LzF?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/668B) /

Resource Hash

a9e178d4b5e61191a00313e514328f68c5863e01d61e35b7d240ab3063492b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 78562
x-cache: HIT
content-length: 21104
surrogate-key: media media/bucket/9 media/1424824714996899840
last-modified: Mon, 09 Aug 2021 20:05:38 GMT
server: ECS (frb/668B)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 854c28fb71de583b62ec5bd65d8f1a56d0b4b565bddad2963febacec58f604a7
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8WZM8fWEAY8zAG
pbs.twimg.com/media/ Frame C25D 26 KB
26 KB 19ms
10ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8WZM8fWEAY8zAG?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/674C) /

Resource Hash

72a4d123787758de6d70953d11245a4434dd4bb913cbb806310a6f466a7864af

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 104926
x-cache: HIT
content-length: 26498
surrogate-key: media media/bucket/2 media/1424713304807706630
last-modified: Mon, 09 Aug 2021 12:42:56 GMT
server: ECS (frb/674C)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 3a60d22af14763daea111e1dcfb9fa13f7226b6749d8e951fe5f2e68f13d4d01
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8WRY7qXEAMlC5O
pbs.twimg.com/media/ Frame C25D 34 KB
34 KB 10ms
10ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8WRY7qXEAMlC5O?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67DF) /

Resource Hash

acf4cf762493e87f8dfce3205fc0c06296e98f1980029cec2f90a56ac890dd44

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 107212
x-cache: HIT
content-length: 34540
surrogate-key: media media/bucket/7 media/1424704714650882051
last-modified: Mon, 09 Aug 2021 12:08:48 GMT
server: ECS (frb/67DF)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 4c77f337797f01c99268a3eccc373dc08d36bdb69f862a8ebbda13d58136c187
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 E8WNx_jWUAIyleK
pbs.twimg.com/media/ Frame C25D 26 KB
26 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/E8WNx_jWUAIyleK?format=jpg&name=360x360

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6795) /

Resource Hash

65b5eb0e2696f23e31966459d736453800cadb5ebe56a0ac4bde97519e53b183

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
age: 108140
x-cache: HIT
content-length: 26201
surrogate-key: media media/bucket/3 media/1424700747145433090
last-modified: Mon, 09 Aug 2021 11:53:02 GMT
server: ECS (frb/6795)
strict-transport-security: max-age=631138519
x-tw-cdn: VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d184f4b1c861e23af573ba7215ec8a629417c98f3736159ee78d217d88827616
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H3-29 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame 6907 1 KB
732 B 40ms
37ms XHR
application/x-javascript 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%221554908878104117%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F%22%2C%22width%22%3A300%2C%22height%22%3A600%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Atrue%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22http%3A%2F%2Fzaytung.com%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__dyn=7wKBz84e1QyUbFp63m1FwAxu13wqovzEdEc8uwdK4o6O0TUhwem0nCq1ewcG0KE33wooa81Vrzo5-0me0sy0SU2swdq0Ho2ewnE0Caaw&__csr=&__req=1&__hs=18856.PHASED%3Aplugin_default_pkg.2.0.0.0&dpr=1&__ccg=EXCELLENT&__rev=1004264780&__s=%3A%3Ai7xg6y&__hsi=6997459799725346681-0&__comet_req=0&locale=tr_TR&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3db6858bb511d708ce4e9f9005239d50c1277257b1c48a24b1ca209541cec4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: 6IZ5e1hl51fiX1rzvcSbU6
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: xgYQVuqUoG6WPtOLjmrTccje6LSzq5HE1uZ5eTdNz4MF3EicY5kKvxbe302Q8H4nNO3UVIv5CEZOztOsv1NlbQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 17 Aug 2021 17:57:50 GMT
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3-29 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame 6907 1 KB
739 B 33ms
32ms XHR
application/x-javascript 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iR5z4/yX/l/tr_TR/LbmZCDFNYok.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a53799b3b4eb122a73aa9797cacfcf7c50ac32a869e67c6c842a01e3e0a1b53

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: 6IZ5e1hl51fiX1rzvcSbU6
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: oCi2rqCDXd2eIn4jlc4FBV1T/uQQyCngeX/9v0SOrcZJ73DX3gf1Hv99F5DqtNlJS+70+talWq6XjKLPwPh8bw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 17 Aug 2021 17:57:50 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 C07F_TNoyQ0.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yT/r/ Frame 6907 19 KB
6 KB 10ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yT/r/C07F_TNoyQ0.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8040782c684c1c1b373a0c84d042cd3b4e953dfeec2894962424d576e2347cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: F2+o0UpT6xz/iezbo90yWw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 6351
x-fb-rlafr: 0
x-fb-debug: w06a301A3gN3Qia84IghsEQEvG+6xvSF67ssNLPoViDZhIRPAvUJ+6EFwIPyHaWFc0QlxL8Y031CG6HXBjm2/g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:05:24 GMT

GET
H3-29 200 cN-N4Eu_deZ.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yv/r/ Frame 6907 7 KB
2 KB 9ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/cN-N4Eu_deZ.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

095eceabca5358699a8efc64f4e44b27576d45c2ab864f1f50c3401676f9a827

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: XkHzn1WHKMxOAJmWI3FJ7A==
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net;frame-src *.facebook.com fbsbx.com;report-uri https://www.facebook.com/csp/reporting/?m=c;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2277
x-fb-rlafr: 0
x-fb-debug: 6VsbggWm5BEcRhsn1yT6craKDnHiGbOyISmWIXBsbqcC2jdW9ja3j0cUMcJD1F+Ggnh8VywB6Gbkjw2wcHNA6w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 12 Aug 2022 05:30:00 GMT

GET
H3-29 200 onuUJj0tCqE.png
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ Frame 6907 4 KB
4 KB 9ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/onuUJj0tCqE.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5f71fcc2d00d22ffd4d9a07b64c435f88de80893f838fa64a45c386cbba0c601

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/7expTFhmPeK.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: UpEjWmOL4QHl/yQwqJlcFeZGhQ5rJz0mOIOXovJuOwggOg3CIYJF8oJ5nSnv4Jd9ljbq5m66OBp9VGsphw+VMw==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OK0dmVpVmdoMRpKMP9eDcg==
date: Tue, 17 Aug 2021 17:57:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3944
x-fb-rlafr: 0
expires: Fri, 12 Aug 2022 02:33:10 GMT

GET
H2 200 / Show response
pips.taboola.com/ 64 B
237 B 29ms
6ms XHR
text/plain 2a04:4e42:3::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: 163c5edc91f9c49c92cc2c0316236267126527c386bd63ecf6fae68988ca2b92

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
via: 1.1 varnish
server: Varnish
x-served-by: cache-fra19172-FRA
access-control-allow-methods: GET
access-control-allow-origin: http://zaytung.com
cache-control: no-store
x-cache: HIT
accept-ranges: bytes
content-length: 64
retry-after: 0
x-cache-hits: 0

GET
DATA 200
OK truncated
/ Frame C25D 512 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame C25D 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame C25D 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame C25D 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 42ecd6904f43af4e6cef62ddbeffa7b2b0b6c8ec5080a3e1deec4576f4294859

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame C25D 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 195e8e91bc727766f427243d4cfb79cdc873639991600bf99e9d2cab5cad77c8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3-29 200 OZcLupMIkEN.js Show response
static.xx.fbcdn.net/rsrc.php/v3/ya/r/ Frame 6907 245 B
220 B 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/OZcLupMIkEN.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1012db27ec1cb433b46f471bb11c18fec71f59c5fa6f6520c87ff374e4ef0325

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:50 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Sj0Q4egSj1eTua951vhlbw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 165
x-fb-rlafr: 0
x-fb-debug: rjqs/y4egkYfje0bvPclxN8M3xdF4znLrUwTG8Te6KjIcxT9NICjHEHxfKClKiUOyFGeJ2vfYur0yyMAhWMu1A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 14 Aug 2022 02:06:29 GMT

GET
H/1.1 204
No Content / Show response
cds.taboola.com/ 0
155 B 2345ms
97ms XHR
text/plain 141.226.224.32
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.taboola.com/?uid=9e3b2ab6-48ef-4a77-9c6f-dfd0fc38ecfd-tuct8157e1b&uad=2fdc9dff64e35c1da87224be72196d266a5a59834b754e4e186adb6e48c6938f
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 17 Aug 2021 17:57:52 GMT
Cache-Control: no-store
Server: nginx
Connection: close

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4891
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=

281 B
554 B

30ms
28ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Requested by: Host: am-match.taboola.com
URL: https://am-match.taboola.com/sync?dast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&excid=22&docw=0&cijs=1&nlb=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://am-match.taboola.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://am-match.taboola.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Date: Tue, 17 Aug 2021 17:57:50 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 8B1A 31 KB
10 KB 32ms
32ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1ad9d6b165677395567bf502cbe71eb301894db97acfd415caf2d8638f2b3413

Request headers

Referer: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Jul 2021 17:07:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17675
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9360
Expires: Tue, 17 Aug 2021 22:52:25 GMT

GET
H3-29 200 /
www.facebook.com/login/ Frame 6907 0
0 112ms
111ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fv2.2%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D1554908878104117%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df17fd14cd9f6f38%2526domain%253Dzaytung.com%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fzaytung.com%25252Ff199a47a4129d24%2526relation%253Dparent.parent%26container_width%3D0%26height%3D600%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzaytungstore%252F%26locale%3Dtr_TR%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dtrue%26tabs%3Dtimeline%26width%3D300

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /login/?next=https%3A%2F%2Fwww.facebook.com%2Fv2.2%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D1554908878104117%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df17fd14cd9f6f38%2526domain%253Dzaytung.com%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fzaytung.com%25252Ff199a47a4129d24%2526relation%253Dparent.parent%26container_width%3D0%26height%3D600%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzaytungstore%252F%26locale%3Dtr_TR%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dtrue%26tabs%3Dtimeline%26width%3D300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.facebook.com/v2.2/plugins/page.php?adapt_container_width=true&app_id=1554908878104117&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17fd14cd9f6f38%26domain%3Dzaytung.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fzaytung.com%252Ff199a47a4129d24%26relation%3Dparent.parent&container_width=0&height=600&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzaytungstore%2F&locale=tr_TR&sdk=joey&show_facepile=true&small_header=true&tabs=timeline&width=300

Response headers

vary: Accept-Encoding
content-encoding: br
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
x-fb-rlafr: 0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: uAJnyPpCrBkQfnLmCR3VwpdCAxcjVGipf2NaypeRkOLXUwdymRIXEdcO1zaBqyNECrQfI307iWKLZKwtf/NpUQ==
date: Tue, 17 Aug 2021 17:57:50 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame BC4D 31 KB
10 KB 52ms
31ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1ad9d6b165677395567bf502cbe71eb301894db97acfd415caf2d8638f2b3413

Request headers

Referer: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Jul 2021 17:07:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17675
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9360
Expires: Tue, 17 Aug 2021 22:52:25 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4891 31 KB
10 KB 82ms
32ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1ad9d6b165677395567bf502cbe71eb301894db97acfd415caf2d8638f2b3413

Request headers

Referer: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 17:57:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 12 Jul 2021 17:07:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=17675
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9360
Expires: Tue, 17 Aug 2021 22:52:25 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D556 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BwLoWm_gbYbZ019ht7qqP8AgAAAAAOAHgBAI&bg=!1Nel15PNAAZvV8FTb1c7ACkAdvg8WmmRbO-dt_LouNf2VCA3G_gm1Md9U3qJ4smgA_TIb8Vqlc631wIAAANVUgAAAApoAQeZApQGrgWDLUrqNeuLhQpeeX022LBjHKK-3TDfRkom2cvwUoA7NAFKv6LrriU4oCMpNuKLyIzddpOJOKWwWJS-7JH_v5ZanQfLPERVFx011v3Yq_zLS_31r4J5RpbbrLS7G6nMRLtZu6ADYPTu97ZVxqA8WQRrhOjQ7T3ptHsEo_5Z1qIy-EAytEugafxq0h9NlmIXZG5fkOJ08JhLzA5QeIx6M7q7hl2Eko19DWuNXl6yTq_4C4FMFsItDq34gLUUC0jvDyiTwJ2p51L5sBjXxtErPmH928hVsExvScvNrMoMqYsmGpw9kE2Y13xqWNACmTkbbSqlX8zec3S5Fe3lUUWi4xTeam-6fueo3Dd5uVc7-K3m87Wchp-Xe-DcHjq0DiAGiKnUZwbZ5uPvhGxl0vQaB4PyOf--PoLfFNE_BJiJePo9chYhQBkV2U-_o8HDqABm6TK_dttzYB7EfdTn_uoZC-0y6wb7CJ1WT3U-Fyj4NzrYRSp3JblQCEXSqNio8w06y048qNl_hQf8-QmD_23xV4WETzDin4wy-JnnK_Jd9Pn71NGcFaOxLnAi9Gk4Ph8Nwj092bWKCQp81L_VovBYIDmKNw2EzvaOvyQPRWU2lMNdvq-LvH616WJIF-HhnuozmATRFyYd0HQUwKnCAWHn_tLbDzX4kcB006r6rXmsk8uAnaSVYMOlWRmVeScT068SZsYg72hN3r4ELCAfaJ5u7vi3DDuONFia5QeYrg4RNLkBClWCU6dVkYzrCs8TwKUHeQKJ3JoOMc2Lq5PYgfFU0AGWaAqdT3fmSrDchGfIfaC0lHwfoH53zNbnbVMFz93vMdO9cAoMDzcAjxHB0DXj110Q_xPzk1R1l8QNmKflKF2li1s

Requested by

Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 8B1A 284 B
536 B 183ms
30ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?gdpr=1&us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=1&p=15414&us_privacy=1---&endpoint=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/jpg

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame BC4D 284 B
536 B 184ms
30ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?gdpr=1&us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/jpg

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 4891 284 B
536 B 182ms
30ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?gdpr=1&us_privacy=1---
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/jpg

GET
H/1.1

200
OK

jot.html Show response
platform.twitter.com/ Frame 4692
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

80 B
571 B

6ms
6ms

Document
text/html

2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: zaytung.com
URL: http://zaytung.com/fotohaberdetay.asp?newsid=395636
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6763) /
Resource Hash: 90214d135602962e47ea9587a7eeb62fac1c64a541e373ea76e2b4e8b33e3f88

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
Origin: http://zaytung.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 701974
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Aug 2021 17:57:50 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Mon, 02 Aug 2021 20:34:56 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6763)
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 80

Redirect headers

date: Tue, 17 Aug 2021 17:57:50 GMT
pragma: no-cache
server: tsa_o
status: 302 Found
expires: Tue, 31 Mar 1981 05:00:00 GMT
location: https://platform.twitter.com/jot.html
content-type: text/html;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
last-modified: Tue, 17 Aug 2021 17:57:50 GMT
x-transaction: aaaf51a76f389e5f
content-length: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
x-connection-hash: cec8f55390da43ad7f480632357d7b93f48005519076a6ba9771b5b3c951e5ce

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 20ms
20ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210812&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

222b41ea00734001fdda12af71d95754d4bb8520fed3e1ed3465979033e9b0ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 17:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8473
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 17:57:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 17 Aug 2021 17:57:51 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 48BC 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Tue, 17 Aug 2021 17:52:35 GMT
expires: Wed, 17 Aug 2022 17:52:35 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E947 783 B
533 B 15ms
15ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ba0698a67189974b1aab020e67d13963d33b1538aa067a6197334a5a4f999d8e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-o1DCEXN9H3csBEym7SXF3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://zaytung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://zaytung.com/

Response headers

expires: Tue, 17 Aug 2021 17:57:51 GMT
date: Tue, 17 Aug 2021 17:57:51 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-o1DCEXN9H3csBEym7SXF3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js Show response
pagead2.googlesyndication.com/bg/ Frame 48BC 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:40:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13273
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 15:40:22 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
121 B 41ms
41ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210812&jk=790460311999216&bg=!8vGl8bXNAAZvV8FTb1c7ACkAdvg8WrW8N8ILZI6H1MTmwC-NjvoHZ5QH3lvYF2cyMUmrTm4Vosx3dQIAAABYUgAAAA1oAQcKAKJSCHUVinDuHIdKuUo7f4i0k80pJ0XmXZaNMT4xgpEW2WS9o3G93W5YwJvFkVEgPe6wAN96RdxXLsXogV_bq6whzNo0hRb-8ONxgfeqAslnGHZBRg-7LFcEHvvy2nnyrFtgXJhVBik-WG2m5ZkQHWBBwvLkXfqpaLWaFBsqT3fofbw6bJR7jZ88kcsIVehhxBxqYlsS9hFJKtXXEPe1a6vXFvmZAmgR2XsXecGtuN5gZWdpSXt82BzwSWYDKiV06aJWFEU5_F_aGOnxewmAaBeAJFnx8wcSt01IRNNDkGk7jWBfLdHQJvK1AhglfLULvE3Q7tz9D1nfQqTJrIL4JDjnKueglpU-rSzIonxksJobbv1VHl-jWB0f22WtxGXcJ4gUXGjoTe8DJ-Ai5FYFcZpI0FioPtMfNZ0hlOKcp69uZX2AS-En3tZxPyB8d56UBftPGSu2-cAJYAoQdxK4rT40y24fnfwJhfuhwFRBA7dQujoL3bEBHK3SMAXAOCKVoGCyjA3minq5CBsiUZJIk8GsyCvLT-c-xPw29JG7yMBWE9FGg6040tNXec6Ip-nEXR0jv3NZdVlM4v5AiabXs1wCNkUxxUdzwu9KtsB3yX2zEMLwU6u5nm-r-8nOuqEkiluIqvY6Qr-giecfm3mL4sMN0lUY_moigv8_CsyNrr9Qxy2JbN77xsRjYKUiVENNm7vyeWXUJOtlzcLWEW3U5Z0Bl06PTOfWJ88W4RVJ3V_2zo4ulQ1oK9vuSBNvwvA8_uvUqzMH3O99oy6CGmlt1ma4pKVjv8mpBlqgzkSdDBydrgc3K6numrTo6gTGh7S_jguLD3G3Fmhu4sp5bfEq7kFzFlYLgNQyXWPS1Tk_G8yKHUc3ycWwJyIpRsFo-CCTFlzASoWoNfJpP9azxbtElw3gKIyDTv4tBy4YHU-jP57e0c4pc5sOdj-AhMb9mUVOox8Exeq16nOwzBikFeJ-3Q704Q5f77uga7CKl0O5nfG9wBOPGwMoTJV4Zt-C_-jQL7ej6ztk_Xh79ZKE51Po

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK VideoBidRequestHandlerServlet Show response
wf.taboola.com/ 1 KB
1 KB 2618ms
91ms XHR
application/json 151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=416&height=234&pubid=169497&tagid=953497&crid=5333395&noaop=5&sortOrderType=0&cb=1629223074440&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=2&pv=1263&pt=-1584714866&tz=120&viewable=true&ddast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&proto=2,3,5,6&encoded=1&pstn=vforce2&callback=&wfv=1&amp=0&qsz=7&ft=0&pb=0&pagg=1&sd=undefined&dtagid=1705875&dpubid=286345&abtst=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm_vA&mPre=0.033&cirf=http%3A%2F%2Fzaytung.com&en=1
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/vPlayer/player/v12.6.3/OvaMediaPlayer.js
Protocol: HTTP/1.1
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 51e7fe40a6e46a274f84adeda41f43cfd9ed84266de404e61f46c23d97972d48

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

Date: Tue, 17 Aug 2021 17:57:57 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: http://zaytung.com
MachineId: 1458
Transfer-Encoding: chunked
X-Cache: MISS
Connection: keep-alive
X-Served-By: cache-fra19123-FRA
Pragma: no-cache
Server: nginx
X-Timer: S1629223077.989635,VS0,VE54
Vary: Accept-Encoding
Content-Type: application/json;charset=utf-8
Via: 1.1 varnish
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8D4B 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=html5-mon&a0=layout&f0=layout&s0=0&d0=461.0000&a1=https&f1=layout_html&s1=0&d1=11.0000&a2=https%3A%2F%2Ftpc.googlesyndication.com%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2Findex.html%23t%3D3247801068590952500%26p%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net&a3=https%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fgadgets%2Fhtml5%2Fapi%2Fexitapi-impl.js&s3=27.5000&d3=12.4000&a4=https%3A%2F%2Ftpc.googlesyndication.com%2Fpagead%2Fgadgets%2Fhtml5%2Faddata.js&s4=27.7000&d4=12.4000&a5=https%3A%2F%2Fs0.2mdn.net&s5=27.8000&d5=48.8000&a6=https%3A%2F%2Ftpc.googlesyndication.com%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2F5ea98cc9e7a03d000f7927c6.png&s6=102.5000&d6=10.1000&a7=https%3A%2F%2Ftpc.googlesyndication.com%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2F5ea98cc9e7a03d000f7927c5.png&s7=102.7000&d7=14.2000&a8=https%3A%2F%2Ftpc.googlesyndication.com%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2F5ec261cb9c3f8500117de642.png&s8=103.0000&d8=12.3000&a9=https%3A%2F%2Fpagead2.googlesyndication.com%2Fbg%2FLPVuzLK1TyzEP0FlVkI4C3aV71n8MLJs6dtRUJPDU8s.js&s9=515.8000&d9=7.9000&a10=https%3A%2F%2Ftpc.googlesyndication.com%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2Findex.html&f10=Custom_layout&s10=-1&d10=-1&i=474681880932&t=419&c=p&lp=%2Fsadbundle%2F%24csp%253Der3%24%2F5165121183719721941%2Findex.html&gqi=mvgbYbHsKabgnsEP_Li-gAM&qqi=CJb0mfHQuPICFUviGwodVv4DOg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:57:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 VideoBidRequestHandlerServlet Show response
am-wf.taboola.com/ 1 KB
947 B 126ms
106ms XHR
application/json 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://am-wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=416&height=234&pubid=169497&tagid=953497&crid=5333395&noaop=5&sortOrderType=0&cb=1629223079443&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=3&pv=1263&pt=-1584714866&tz=120&viewable=true&ddast=V7LoECFgNf4lYxgFACdgRf4lYxgFACdgUAAAAGBuIHHMKgjGgz4nBBWO12u8ViuJgsBsPBcrBbLofAIQzKiDYjDheE1W63WyyGg8VyNBkOB8vFagoRSTc77S6DqOh6W-wOp9nzhhk0nQ7XvV76cJ5ed59d43f7ZX7T3-iwuCwnl-nhvCs8h__c5fs8Te7NcjXbzOYAAAAA8AAQFTYJ8QMIABABAAAAIAEAAABAEVDxbyFwAQAAAIABcKBQrQGQxEHgTo_LHwAADwUgAAACGCQABF6JJQAaB5MnAAAAAAAAAAAs_____zED8sznMgAfkgM9AA8-AA9EBalFjAAAAACkzCTkjiR1QmVRBQBAkG4FcAUAELBXNRRSHgYAABAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YRcmJvTgNABANR-AQEA1n4BAQDY1A0A4E0ALugIWjEYrC4gZgcAAABw9____68HAhvTYOWYuSar5cywcs42zuHEM_MNlxvTyLYZ7bYH90Lniv_GXd8XkXSz0-4yiIqut8XucJo995uwxWg1mWyWw9lyMRkMR8PRaH8CuBzgRAyWy8lkMdmtRqvRZrgbzQYLFIjBBClaNJisRqPJYjJcjSar2XKx222QolWr2WgzGK5mk9lutxoOhsvRCCdsMVpNJpvlcLZcTAbD0XA0GiJMrjwTy8JiW4uGK5tbtPDt1sqNbeYW2UyGmcczXHlsJrfo9TEdF6vdyjHxomAAx14EF-lE-nCeXnefRSzRnCzSieyyL2xMg5Vj5pqsljPDyjnbOIcTz8w3XG5MI9tmtNs3V56JZWGxrUXDlc0tWvh2a-XGNnOLbCbDzOMZrjw2k1v0-piOi9Vu5Zj4G7PJcjLZDGa7fWM2WU4mm8Fst-_QGb6rz9lo3RY7HpfYoHoZjzHzQeEyWLxP1epi7I4O5mjz6JSZNsqCzig7XoReg8Jz8JjGy1vtWN4-m-njMOE4GBSxRHC6SCeil_F0EUskT4t0orI4F5OJcWRYLFYTw2a32vgWq9XEt9ssBqONbTIRS5Smi3Sil_lNf6PD4rKcXKaH867wHC7qPzbgZK4YTOaK4VyxGK0SAAAAAAAAAMAS5sybAAAAAJwGMpxtRqvlAkRY7uoCgwAAAAAAAOxa4CEtNaoTDxY3fnygD-fpdfeZebNnglir1bIGAAAQwAYAAAjg1s17ABockgM!&proto=2,3,5,6&encoded=1&pstn=vforce2&callback=&wfv=1&amp=0&qsz=7&ft=0&pb=0&pagg=1&sd=undefined&dtagid=1705875&dpubid=286345&abtst=adh5c-1_vA!insc_vA!smbs!spa2_vB!ufm_vA&mPre=0.033&cirf=http%3A%2F%2Fzaytung.com&en=1
Requested by: Host: vidstat.taboola.com
URL: http://vidstat.taboola.com/vpaid/vPlayer/player/v12.6.3/OvaMediaPlayer.js
Protocol: HTTP/1.1
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: 51e7fe40a6e46a274f84adeda41f43cfd9ed84266de404e61f46c23d97972d48

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 17:57:59 GMT
Content-Encoding: gzip
Server: nginx
MachineId: 1436
Vary: Accept-Encoding
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: http://zaytung.com
Cache-Control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 dc_oe=ChMIwM-z8dC48gIVm-MRCB2dyAsdEAAYACDDuJ5J;met=1;&timestamp=1629223081232;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ 42 B
515 B 405ms
97ms Image
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIwM-z8dC48gIVm-MRCB2dyAsdEAAYACDDuJ5J;met=1;&timestamp=1629223081232;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://zaytung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 17:58:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPKuRDlwTijt4X4arwQhdz_TTzGxzR9NFU1qAEF7j2sp1Syis7oUXjSHsRj7zudIf7ctl_AdORlhaOvU6tGOMzmklV_9YdA

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_push=AYg5qPIYLzJIZK1K7cKgIL7yDRQreJZFw3Xl1Iw_197BRE-lJdgRWo9-JJs6NXEsBvvPxZ1ETsY3dwdczm0OUaGqThXXmXmqPYc

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLUOHbaobH8mjlMNUDFRkVECnsamAZ1SAhIo9X9-zWCAn7h0d5G6k5ysGA8Pm6Yr5M1OvNPHdxsv8TVwn53fDukID95DEc&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_push=AYg5qPLD19R34rcviMDR_99Ezth84eYKm-kfhhPGkp4_F9fVLO5RNzwxDXVv4BoDsuSYkOOrZFmgf2N1fzEdvRH-MmAwr_Du5RI&google_cver=1&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YRv4nDFU0_nVI66PK4U_RAAABJkAAAAB&google_gid=CAESEDPKeAdejmuwrMbtmWXK_fc&google_cver=1&google_push=AYg5qPKvdqE7mDQBh7hykH-wMaTc_RbVpuHfT_3i5-XRTVASVKWJ0Tfbt9QP0tL7x4AoSqAZoFOeyo3Fzm6Ay47A9teDt25Bkn0U

Verdicts & Comments Add Verdict or Comment

315 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.taboola.com/	1970-01-20 05:19:19	Name: t_gid Value: 3d5e3e51-9ab8-4950-82b7-1ae9ccb08c52-tuct8157e1e
.hit.gemius.pl/	1970-01-20 06:02:31	Name: Gdyn Value: KlxhMMXGQMGGBK8EV0AMkfXissGMXP8c25nSGssIIm78EMxnGoG1oMjIL1BGGBPDGtGaEFQpmsMQGs..
.doubleclick.net/	1970-01-20 05:55:19	Name: IDE Value: AHWqTUlJNEmIwrThmsCuJD1gtk95RnGrYccrmTG79vHvrQjTlymf-Yw_hWqhC09oWmo
.doubleclick.net/	1970-01-19 20:33:46	Name: DSID Value: NO_DATA

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1) Message: OneSignal: Using fallback ES5 Stub for backwards compatibility.
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: GPT synchronous rendering is no longer supported, ads will be requested and rendered asynchronously. See https://support.google.com/admanager/answer/9212594 for more details.
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz(Line 57) Message: ErrorUtils caught an error: Cannot read property 'content' of null Subsequent non-fatal errors won't be logged; see https://fburl.com/debugjs.
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/J72p10TEgyp.js?_nc_x=Ij3Wp8lg5Kz(Line 57) Message: ErrorUtils caught an error: Cannot read property 'content' of null Subsequent non-fatal errors won't be logged; see https://fburl.com/debugjs.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
5ce8e45dc58a5838499157eff74ba462.safeframe.googlesyndication.com
accounts.google.com
ad.doubleclick.net
ade.googlesyndication.com
adservice.google.com
adservice.google.de
adx.adform.net
ag.innovid.com
am-match.taboola.com
am-vid-events.taboola.com
am-wf.taboola.com
apis.google.com
app.pubserver.adhood.com
bh.contextweb.com
bid.underdog.media
c1.adform.net
c3.taboola.com
cdn.onesignal.com
cdn.syndication.twimg.com
cdn.taboola.com
cds.taboola.com
ce.lijit.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
cs.admanmedia.com
d.agkn.com
delivery.adrecover.com
dis.criteo.com
dsum-sec.casalemedia.com
e.dlx.addthis.com
e1.emxdgt.com
eb2.3lift.com
edge.quantserve.com
eus.rubiconproject.com
gdetr.hit.gemius.pl
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
id.rlcdn.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.taboola.com
imprammp.taboola.com
inv-nets.admixer.net
jadserve.postrelease.com
match.adsrvr.org
match.taboola.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
pips.taboola.com
pixel.quantserve.com
pixel.rubiconproject.com
platform.twitter.com
pubads.g.doubleclick.net
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb.openx.net
rules.quantcount.com
s0.2mdn.net
s1.adform.net
scontent.xx.fbcdn.net
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
ssl.gstatic.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync-t1.taboola.com
sync.search.spotxchange.com
sync.taboola.com
sync.technoratimedia.com
syndication.twitter.com
taboola-supply-partners.tremorhub.com
token.rubiconproject.com
tpc.googlesyndication.com
trc.taboola.com
trgde.adocean.pl
u.openx.net
udmserve.net
vidstat.taboola.com
wf.taboola.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
x.bidswitch.net
zaytung.com
cm.g.doubleclick.net
104.109.78.125
104.111.215.191
104.244.42.8
129.159.70.95
141.226.224.32
141.226.228.48
142.250.185.226
142.250.185.230
142.250.185.98
142.250.186.34
146.0.227.110
151.101.13.44
172.217.16.130
172.217.23.98
178.250.0.163
18.195.155.181
18.195.240.234
185.33.220.241
185.33.221.52
185.64.189.115
185.64.190.79
185.64.190.80
185.64.190.81
185.86.137.132
185.94.180.125
198.148.27.139
2.18.234.21
2.19.35.65
213.128.72.10
216.52.2.19
217.182.200.20
2600:1f18:612b:4264:c62f:533:271f:3e7e
2600:9000:2104:5400:6:44e3:f8c0:93a1
2600:9000:2104:7e00:5:c4ab:c3c0:93a1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2606:4700::6812:353
2606:4700::6812:e234
2620:116:800d:21:51e4:db4b:4436:b305
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:802::2004
2a00:1450:4001:802::200e
2a00:1450:4001:809::2002
2a00:1450:4001:810::2001
2a00:1450:4001:812::200e
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2006
2a00:1450:4001:831::2001
2a00:1450:4001:831::2004
2a00:1450:4001:831::200d
2a00:1450:4001:831::200e
2a00:1450:400c:c08::9a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a03:2880:f145:82:face:b00c:0:25de
2a04:4e42:3::300
2a05:d01c:1d8:8101:8678:af0d:fda8:5a84
3.127.7.254
31.186.16.22
34.98.64.218
34.98.67.61
35.227.252.103
35.244.174.68
37.157.4.41
37.157.5.73
51.89.7.198
52.208.41.69
52.59.79.213
68.71.249.118
69.173.144.165
75.101.244.20
76.223.111.131
76.223.111.18
88.214.206.142
92.222.208.206
92.222.252.172
01e51940762b45561e5a0c1ea5e5ad122f4c732178d0cb428f8f4409030efb13
022faf125f122d1c715d2c7d3bc274b0adcf8c394a08972057c2078b1f853ff8
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
064ab2f7de7a6fccb0f068fde0120d3419ef182d7e6b6ba8f42759c0fd4853d5
065c36f31d6182f255b92d155783e80529680ab90f4ed3029b96269be6306321
07000140ab52c28ef2a522fae638638b2783786e8e2ae8cb883cc1f0a0c00df0
095eceabca5358699a8efc64f4e44b27576d45c2ab864f1f50c3401676f9a827
09bb79a95989d2461e800591165b89d2ec8cd8dc52303d10f2128f224f7dfe0f
0adcb9b5d30ca41659c2f071ea14ad341a2ff625852fd71ce3ba9529dad2620c
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c20cb6dfa1eec472f1358de556e4f52ef3d0077c6d013228b80b8e3608b082f
0d0e4b36498928026e593b3e5fb37f307c097963e5ba13b576f703051d035c97
0da8b681b5b73ff645ff5d1312a7a6e7db5f568d6ee68ad10ce77b142d5b7735
1012db27ec1cb433b46f471bb11c18fec71f59c5fa6f6520c87ff374e4ef0325
1121d7f8fb131bce05cbaf9b75a1272f9fbed57a53cd239d2fe91ece63ed9424
1157556a79b9b9ed1f42f16a1b72326d21a57cf5efcef8c4d3b54264d2d4b94c
1158d8967fc1ccb1b4570f534ea9df97bd5a8a6c6752399fbdfc652a716dd6b3
11f42ca857ce06541d88c7bb60a1d098fb97578ad43f919b1995e05b9f9f62a9
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
137bdadd875cc13a2fd1fedba8caafe72fb14e7fa3418504763bba06bf27f500
1420c2a616574cf59aa85c88ff8a38a16592a4fdcbea26639b5deeeea2452251
150fa898a18e060aca2b25111ce1c3684bba1a7b71e0f17c1f30efe942a6b2ee
163c5edc91f9c49c92cc2c0316236267126527c386bd63ecf6fae68988ca2b92
16c5aa4f740261df7ee695003ad842648230293d04af7bcb593b15a698f50d48
174c0f93c5b7e81d6c9616c4991a3f493be0e4b7c6165d52d578c567a95fe5c5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
195e8e91bc727766f427243d4cfb79cdc873639991600bf99e9d2cab5cad77c8
1a846273fa4ea7bff5c30208e231892c7357097f02f351b9e483ffcda21651d3
1ad9d6b165677395567bf502cbe71eb301894db97acfd415caf2d8638f2b3413
1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1
20c606ca6dc060b2b665a33b9421aff93531a5290186538bd8e633f114de1b7f
21982a18f1360637951a71b7cf95e5aa0828f76829f35345e4cac3b68ed67cc2
222b41ea00734001fdda12af71d95754d4bb8520fed3e1ed3465979033e9b0ff
22f39fe4943f46a43d768c45e783e37027955efa064887342bc1dd6c572febbc
22f64f87aa926a55ffdcee4b8d2b378890f8b28c12ca7167c7ee674f060e8091
241b5636b95eff1e9291d6f60c1302cd6f9031b20153aa1d2d2f2a9c0a400310
2424c418cd00e6b522d0bf97e38bfbfb2d743a34d46bb1f6ca8ec433227a2bda
26f9321adbb48980c48e7614fc682581346172514dc2786be1bafb5007197037
27b16607878ee37c98fab6b48374fa3e23907433e013250f050aa183b4861e3c
2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391
2cf56eccb2b54f2cc43f41655642380b7695ef59fc30b26ce9db515093c353cb
2f0ada681035b5624a2bf0d70db2c9c36db8ad51add41c434013db478ce79c1a
302f1a05af908a68e88e4e42cf61b0a36cd3d01e0ba4186bd3c48d05cdb1f0ce
31bb34096bb35efc8f2de4de4a5c7514efafedda3afd4fe4995bbe8564da33ba
32672ef61f5b9b70b7bed6b78696b9cecd6fa760f3afd89dcc0ce7da854951c4
35483321fa1ce3b89cad3c0f96e9563a4ace00810ff296ba92c58a11215b9131
35a6bfb03539bb92a063fd9e15a349ab2e9083a3454beac2de0aab498c7bc1f5
3646f70c890c1423eb7ac39ff74feae35a3c2608a9d761c1b2cf81832e386a96
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36c0ec05d79bd9d3164effc3eca0f1962cd6f82bb1f41cb212e080910be24153
37bfceb04cc7a18df0c1da8269c382b3b088e870ab39a0987ae17a54589b2dba
3879cfab5c83e980dd5fc9fa54947406126dab477cdbcf39478340fe8251f536
39037126357d556f6b322b7968139fe4aa805da915507600e1da3429d7fffadb
3a9e1241a0f339036914dcf96b8892341f69237f1184833809a9637e4e0fc24a
3b4bd8e280d9d0e7d65e47e73dd4544323ba0e2c5211559a28eaa87df8c28bac
3bc4d75b2d1a4bdac9690acfec2c49825fa64a151f08f1d89f87b48662180900
3c50badce7cb97142e754e7c20a9012835a5b7ebec352d6b8cc63599b762b15b
3c9cfaba05ff6f55834fb13668202d553b54919175cc7ecb85747cefd117cae9
3dc936b3c6e476fbbbfea1c5d962f4bee0e3636450608357ffcf9e6e92e0d596
3f25a37faa0703cae1dad16a35bc0bc31b89921732a5b6ac9502ef05732be79a
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42ecd6904f43af4e6cef62ddbeffa7b2b0b6c8ec5080a3e1deec4576f4294859
432880562e769f47fc030ff17cf9dff715022a1b6084d06f4b6fab0012c5e2d4
43b1dd9e449104074001593ecda80f88dd71ec307c5fcd5fb63293aef3fe95e8
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
45b4b694d0438e2b21240e5c27f9dbc677b0753bc9b4a3bdff2520d23ead6306
4674c2d821358b062113b57e17d6b8442cf3f11337c4728a79013b31822d9ef2
47151829dd2d70e1a2164209e1dd73d4c1edf5cf814b6d8d7e39f2cb6f4f70fe
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4af89a39d6c28fd65cbe8d1bad3515280ebdf0430e6633ce59d0920a904ca817
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c5f433afb25fed25ded85b1f5b493d0fa7bb28053fbfd0a8bbfe6f661c5344d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e7681cdfb27c5d0457c58c9f0fe26a68bbf6a8dc88defd3c43826adb1fe6ca8
4f2690aca8d46b45b19d3c6755f93f53600f265113678a37ac8c335c2fb82386
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
503fdac0a96979bca8369899030f3ec8c60d2b9fab161a70f4d9345f31adee60
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5109449fc589b78ebb2c44adad5a57e3ee9f7272ff932e567f7c96fd659b6a75
51e7fe40a6e46a274f84adeda41f43cfd9ed84266de404e61f46c23d97972d48
5370ba1d0040794b042ef3231039061fa29b0e8f34bd12000309ee982b4031d8
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
5737cf798d4dda6b0a9f7119f4ed472213769167acd13a235fb920917bde817d
57b7f2b2bcdd983268775ebc6ee71d208510b285d79dd058f2717248079c59d1
5a53799b3b4eb122a73aa9797cacfcf7c50ac32a869e67c6c842a01e3e0a1b53
5b441eeb9b4277ce032cd2b07234e71a146a16a645d30db1028c9073f57216d4
5bd9ca2f57b6c388332dd095d8c9be87dc71c2e1b78b843515ae758fe05a1223
5c1a14b2872697711a2f9158f1f14f68b51ba9496acac58c9fce2dfaecd60159
5cafed99d91d73a4da8fcd78baaa3142525f0cadad7c04f6e7f8e63ee78eea42
5ce105611ef5dd0ce259fbea30e1a2377beb53ec36be96ced276a1e20ec0df6a
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f71fcc2d00d22ffd4d9a07b64c435f88de80893f838fa64a45c386cbba0c601
60c249056e1e2a6ca061e5ccde6b56c4de267a6e911500eb17aa2d3e13d5f19d
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda
61fe4436f1d882b3acd98fb2763984bacd382664582f4918647b89894f46b871
6258018e9f890f2383a09a2be6df7792affd977d856e7247ace8341f5b5487f0
63120ebeacf1997f60bc2a926346877a23143dca8611ef1a2a31b56a1649716c
6330d93c38185b92516fd8bdb7220ff136b6817c2ef101ed7d822e122066240b
63e1df56cd8fd8e4b27104a1e32b04212e0f621f0577854087df44e88d8ce24d
653046b55dfe454613335784e2dd042cdb70ff30b31f28cf42c683aca28159aa
65b5eb0e2696f23e31966459d736453800cadb5ebe56a0ac4bde97519e53b183
65caa8bf4b963d8313cd2176ecabf77a050ea56b2d81415a8a763ec1ab8fc647
68534908a6bef9d16a393b51e34adb313cb0ca3a53f8b213915c213f662f29b7
688cfdff6487eec489878650058b24113a65fbd5ee736385a1ce170f16903abf
69d4b0c67bb13a4a4e0979f58ccdbd88722203f2dab96ea2af819c4467d98cf8
6aecf13b88a3ab22399f1ca5d6582e89c6360b677febea6f0b9b9abf2dfb7d52
6e07734fe1015f88d67a257108878aed46f82946feba5973a0d306aa927ad71a
6f2e7ef3e0abf02f1a7b8fbdc60cffcdfb206668531e5a7dc6d3fe6b8436ef45
703b635538fee4e4769fee4230187192ff538f2057e4b40b2091688f4a04ed11
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
72a4d123787758de6d70953d11245a4434dd4bb913cbb806310a6f466a7864af
73f955332cf5acaffdd8f2e8fdafa3369fc72002ad7686a95a96fee4eb51a291
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
75a4d4a38e32ddb5c936253543fb8fce75e705a2f791442c4fec59966a3c0703
7888556bd1af991290445183094b24aca96c11d1d701df456e2443e1c2c82c1c
7957504f907ffedfc0d7ec27f93664a47d4d36b36ece1386e74492f753d24025
7a2bd9ab7b0238e27e599bef54782c0f28ee81718040506121ad25c6e7c9d1f1
7a2c6d1f5e90afc6fe4855437344f11a36e35f5b812d72624d40aaca45923a47
7bbd910982260037f1c9d83f2c7fe743e789ca06dd54c9eb56c2598b7b928fd0
7c4387c6c82fa5a0e9e3a5d4de97527ae5daf90de345cec794571fb8c8cb3b1e
7faef21187e15aefd3d8a5a585ca32c66358f597a97f5abd276517eaea1057d3
7ffd27c128c00e42048c9df292d008e7782f087d9ab966183695eb108915c6e8
8040782c684c1c1b373a0c84d042cd3b4e953dfeec2894962424d576e2347cc8
8076c68d74b3580743e4445d714c100871b1fffb259fe86d787fe52ea7585b97
80c51846e84e9218f4e11b80e3427ac33539ca65f2f66d910e059df4e23478e2
819a75e614fd73dfe8100a8f0ed2724b8caef5f5efa94aca54d745a3f88b2d97
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8464273a1f9feac060dd799a4a391b02ca745621afc1384f509cf298fa09ce67
8557661574bfb28b6b8e4a66db193764cfcfbf44810a1b2ffb415cbfda2b1f5c
86d0b0c5c5ac215d1bccc0057a9e5aeaf96554438e7eacc1c8d53f9f3f827b26
8734a99f4970946ef7bae7da6da9f0817a98ab64cd305da2a9b6f515a26ff210
8760a95222231fb57b846faf7443f460c46dbd70ed5867f0a79b858fedb718b0
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a322ede0b619b9051fccbe2a1a31f402f416d45f92c245aafcbe75e42f6f2b2
8c187d19d10be09d0e9f14a381a4bb0607a6d9d64e6328d0fadf8e86602b49c2
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db61f95a8f3554830efc6c3942b7322efef09b9d7f0cbfe32135e0fac106d18
8dd6aa34058c7014b4bd6aede0d669bd0642d173e39a723178dce532f317657f
8e8914ff64b4b1bb311544671f8f0308a882c35b2f3245d13c9b1d89c7f573e0
90214d135602962e47ea9587a7eeb62fac1c64a541e373ea76e2b4e8b33e3f88
910170debb8f5e390ed569fa098a4ffba9fef9b36c9b1c38a76aadc179f903b3
91138c41961a35d849d3cfe00ed582a61a80a2ae33b0f9d5bc0a4eabf98c6127
91c617ff9074d05a5d2da254a5e88b2e74dc1f749a731f134eb5a6ac984928ff
9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5
944015d1bcfbf0e1922312e698422df1e76313a8d3d2e39fe3422d9fee05cbf2
9569288f2b0d4052d3e6e08a132065281a913b68a6e658c912793e3c8d4b1e0c
95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810
964794272aa168ce3feac3a84460c1beb01606da0e303689b8aee75fb354117d
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
9a02214990650642f638f37df33e7cb0d41350d1574191be70220a7943b14392
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9adc529d888b662dc68f832e4a2476ca782af86e3314643edb34a3b35f2125de
9ce3ddea4d143d1c088fd35a2d7bd605b615df2706fad79ab50211ba95386553
9dff9c5d8bb8ff3117fe17757c275af96ca695dc60d7fb811331cb38815a91a6
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1cc391d239011cc8f279135cd083054a901bac123c53d2640a630f938b3cf88
a200d1f3477d0a98d18cca8f92551b9eef5c666dff555d9ad106d9a58fe22797
a2bebff6cf5001f3e217eb00e7d68292251a5835f922e2936eafaab13eafc7c5
a462488cb579d7e57e49b3288366722b5527cd24ea90b84937e1e9da0a819ae4
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5606368e59827b69f57c63e2ea5ae0d1e4dd612da48a4a9ea4a138971786f48
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9406bbb0c5e2d17f41989e3705be66ede7d32888b1fa8088cc04bfed9c863f9
a949fb539e189568b1f490aca4a66fc8024032d692ad4d71d73a13edd8e92d0d
a99cb46cfa6511ac1cfbef44287c6cbd0c213eff46c225a90555c939b0acf352
a9e178d4b5e61191a00313e514328f68c5863e01d61e35b7d240ab3063492b5a
a9e402d2d19f1057cdea09b2152d8cfd35664182564595e19bb83916c1f00201
aa689c0e4e38cb416aaa5b5f28546387fe1f643bb22c608c818e99315cdba3e5
aa7c984cd510935c132345bc7d579dfcde68742f7b11b599b905310f7164718c
ab8bbbaf028510d8b119cce741f0c2cc94816dcc113d83cac81a6aade6a76fa9
ac15d1868a55adcea61641c78efbb86feda3a65882f21bfe9fedd7348fb54be8
acf4cf762493e87f8dfce3205fc0c06296e98f1980029cec2f90a56ac890dd44
ada8ea66db68729537690a16c0eba1d113412ea27672dd0d7b27f3bdcaefc249
adf379f80ce276b9dc4030667cf06a2b68c7bc10908a9cc4d492b8b96aa15997
af5bc8f15add982310c83f99974ad60334e4d3cb98ccbe27d15ab10de7d494b4
b0e95c05b6a1edce180b0d4f07b11eb39545b30a44b6c8f9f2ccc6ed84134788
b0f41667aa2c87263da5a6335162ddceb098029e75d06f94c91da4cd31d12638
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b27de2b4f36397e8236d04c8f2feda33efd9fdf023290d99a9f5c3f5d422166f
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b37047449af1e9f125a38fea044a6b44cf3da8d1050cd8cef53b8c2240371166
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b70aa192cf670ffbccd24885ff71e159e03c809b890abe15e74cce9f497dd8e5
b824ef7d09b98c5461a1b0b8dea0ea64888b745b72a7d446981ccde790f6ff4e
ba0698a67189974b1aab020e67d13963d33b1538aa067a6197334a5a4f999d8e
bae860e25ca7e4c49a479311492df1bcb2bb85a9cf7aac452b6616859f139655
bb0d67c1ebc875aa6814d669702d9b56529ff1f9a39f8aaed99c932cb77d3978
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bcaee944cb8308960f791826aad84abbd1bcfa0bf7b1a3c33437e09dd29d9809
bdf7911fda166082a1de19e0e2d120634a2dd0b9a7a95a2bc22a7c4314476f2d
be1a3d0306d7660043c43c7f0bbdd8d0effc7dba81be0191ed0e561b6538795c
bf2051b1ff1ecdbd06b810288a1ded0bb6eac62c2752b0b5730e1f87522d8f50
c096ce68c8fba8c382e3ec5b8ca7ff347a12fd897ce77a56a5665f53783dd4bb
c0c966c96e68f094bc162fbdf8a1d98788fab813bdbce87eb4b5f2ff9cb14acb
c3b1ca5d98d4076ec5875d96d79179647df3148e16005ec6c2b7e131eabecbb5
c5185a8306597c98061216e7c54266a0b9a1d91f83deeefc4d16469d89cdee3e
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c72c2255f9931e7a24b2fb3c1afd5e37ec8062d9af5aff7f28d7e8170fe5344b
c73c9d1171d61eed712da613c8c70057ea0d058f07ecfadf9515c48a76e2a067
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb0d0ac46d2fe398d02a05a65cdcdfb95797f940a900e08968a70bd8b6f5ef8e
cdfdd2cfbde9c88c4aceeeffea47a3f74051863912ef8229f4d0561b33144716
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d25e323948e70c62a01ef4b7e13f006669f45f53a10f488dbd28603b167dabea
d5decaef1cf2a7030d58e9689486f8cbf049fc0d89ac12f3729743e5cedda6f8
d5f3085127d154cbd72e219052312767d460633fafa6e38bb9a9446ddb03a270
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d69f83e7d24845564dcfc7131aef2d143437b84136fa2d4d371499bd2c673fb1
d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185
d98b97044f4765f7e0d079ac6d838652d73653aa8fef4001ebe80eab5f4e99cd
d99dccc4af2dcb8e3b64249fb88549b5f0368708eec4b4c0acadc177b3ddce75
dbc4c4bd5bf61345f0093760b5d071fd6dbded304f0865db661162a49dfacec8
dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139
dd132d8c17edde5b20077eba3b92f59e3cde111610230293cb4601725d8de62e
ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326
ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5
ded3de6711e90ee906834dbd64ff18636b3f1a2463825e13f2fa0600417bfe2f
e01f922b19c72897e36e730270a7f1a506fa3976dc5ad6cc3b239a5443e806c1
e06a4b89626ecf28bff1ba772e85c78b9365e16a7a536e8904f6b5153e952532
e25b605ba1adfb5e38e4342ead7253da4b9ab9871b3c22ebb26ee6b624dce4eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3db6858bb511d708ce4e9f9005239d50c1277257b1c48a24b1ca209541cec4a
e460d2f4a4bcd89ee69788e97a770479f30c11442ae94430ecc83ae2d60fb13f
e46698f08149fcc909ea36303726078324e20517cd03cdeb10dba4f90bbc0051
e695cb628751f27517b7ae49430028756a9e7aa6377f12c52736d8545787bb2b
e7332b300fff81f63aefec1e2b0c072ee9c28c4565ada0376cd3f0276b99cf01
e90fc13ca6a55830365233e16740a9d8c768951cddb0a3c5f9864e9691ba4cc2
e95623e9082ef2c44c96252359f39cd05a5b21f5155f025a493244d5f7b40357
ec98f88129d5c3180c878d70ae27ffcdf7907737e4d2e82ec41b6f81fe1cd8ea
eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b
ee0f6532ab07489af2489aa7d372170e060241a0b4a935c3be295f95ef775a3c
ee2a6113bbd579c4eab50e3fa4a4757b28db357b67c81abc416007fc59d63bf9
eea89dc96df1b533e47cf2e7201810770a327e6b972f3c531bb3f8c3e87cf6fd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef87b761b7a4de48c8956b8e748e049eeb420793a3886c1e22738cd09dc8eb68
f2964eaaa17b81ff911681e57089511c35c7ebbbb8cce98e8c64bad2de197149
f43807737b5f34b41aa74f0fd9ecf91b69fef778bef1653e32bb36cec1d38347
f493ad8a0161ca8b8f7b1d981c2cecbc1888d40624cec4b650921fdb8608e1b6
f6390c8d956a7f64e65782ade728dd1c30881b91d6c155e8b00930277fd74bef
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f96aad074a7a9e65d9e5a73bfa899c14bd560113713d1a35d188e0b2657eb0de
fa3aced85c09af999107819091cad6b2303651533d0c26081853f08aa25196b5
fc82df2f8041f07089f9f1de17bde75873054929b9b291768798401c210a7cd5
fd1788630511783f0b4c56d7a45e8daf1dc48176082cddfcd5016836f66a4746
ff454325c19246b9f3278830b5e904cd1aa56612629b830139f14dcb9f545b65
ff99c7e6025abc526fb532ed3e0e8cb7248ed4d89b8580939899374cbf230e5b

zaytung.com Open in urlscan Pro 213.128.72.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

443 Requests

79 %HTTPS

40 %IPv6

53 Domains

98 Subdomains

66 IPs

10 Countries

8003 kBTransfer

16156 kBSize

4 Cookies

12 Outgoing links

Redirected requests

443 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 17 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

zaytung.com Open in urlscan Pro
213.128.72.10 Public Scan

Screenshot
Live screenshot

Full Image

443
Requests

79 %
HTTPS

40 %
IPv6

53
Domains

98
Subdomains

66
IPs

10
Countries

8003 kB
Transfer

16156 kB
Size

4
Cookies

443 HTTP transactions
17 data transactions