csgowfire.ru Open in urlscan Pro
31.31.198.184 Public Scan

Software

nginx / PleskLin

Resource Hash

5ff26fe176fa6d4995432de254f358a2e56469fc24e454c29446871832946473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 16 Mar 2019 07:00:20 GMT
server: nginx
etag: W/"5c8c9f04-9b2"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:43 GMT

GET
H2 200 bootstrap.css
csgowfire.ru/templates/mehasha-cheat/style/ 145 KB
23 KB 103ms
102ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/bootstrap.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

45825e6999d268d3f67c9ef03331fc9d4b041712bbfe5d29e6155639aade66c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 30 Nov 2017 13:54:09 GMT
server: nginx
etag: W/"5a200d81-24497"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:43 GMT

GET
H2 200 styles.css
csgowfire.ru/templates/mehasha-cheat/style/ 53 KB
12 KB 106ms
105ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/styles.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

1d15cff80c1a532fec6f5cf601020d542cf012a79cdb22653d64d52c33941c3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 23 May 2020 10:25:27 GMT
server: nginx
etag: W/"5ec8fa17-d250"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:43 GMT

GET
H2 200 engine.css
csgowfire.ru/templates/mehasha-cheat/style/ 61 KB
22 KB 102ms
101ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/engine.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

9080f63613865b823bfad02fe5b6ed49a19529ebd7c362eedf142f4718927dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sun, 25 Aug 2019 14:55:05 GMT
server: nginx
etag: W/"5d62a149-f33b"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:43 GMT

GET
H2 200 font-awesome.min.css
csgowfire.ru/templates/mehasha-cheat/css/ 27 KB
6 KB 106ms
106ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:51 GMT
server: nginx
etag: W/"596f808f-6b4a"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:43 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 149 KB
51 KB 77ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

934300ae2f0ff75f9e8fc23e00358ec716537d9adc3decb4d947caf341bf31ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51743
x-xss-protection: 0
server: cafe
etag: 12125948727961689898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 16 Feb 2024 19:05:44 GMT

GET
H2 200 11gku.min.js Show response
newrrb.bid/ 67 KB
20 KB 128ms
95ms Script
text/javascript 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.min.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d9c122f31c18d9cfcbab4ca1a757c1dfe3b954986a80f700706051c58521674

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
duration: 580833
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 17:43:13 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6VmysDBSkfyjv8nWyp3CJ4shXT8DK1HFFk9EP5MBuGaEyZSWJXgMVLqSFSmrcmnC1qirrdLM8dhcHc%2BWkXb9sNPLe%2Bb5NEhzP3qwqDzBd7umA3vB37TpgC1MQ%2FsyI1uXt1lEvN7soZhR"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 85681052e80c3819-FRA
access-control-allow-headers: *
expires: Fri, 16-Feb-2024 21:10:44 EET

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 349 KB
99 KB 188ms
70ms Script
text/javascript 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

74687cd4c2fd197dab2eebb94b6c4a9dcf52dce732fda694041caa68cfde22b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1708110344255649-1645810956277479284-balancer-l7leveler-kubr-yp-sas-218-BAL-9064
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Fri, 16 Feb 2024 20:05:44 GMT

GET
H2 200 logo.png
csgowfire.ru/templates/mehasha-cheat/images/ 18 KB
19 KB 61ms
61ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/mehasha-cheat/images/logo.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0b2f0d75280ba2ed31b8216245084da11ee4c98a6bef86f9c0115a8b10d70c39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: "596f8091-4966"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18790
expires: Sun, 17 Mar 2024 19:05:43 GMT

GET
H2 200 csgo.png
csgowfire.ru/templates/game-torrent/images/ 7 KB
7 KB 106ms
105ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/csgo.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

7455bbe1a32f19de9a0924ebebe048f19b698de0ee2928eab70127f069231dba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:46 GMT
server: nginx
etag: "596f808a-1b11"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 6929
expires: Sun, 17 Mar 2024 19:05:43 GMT

GET
H2 200 cf.png
csgowfire.ru/templates/game-torrent/images/ 9 KB
9 KB 84ms
84ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/cf.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

203febb9b424cfe4228ec781f754f00a34bbf06d2ff35f30afc26cdc78b093fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:46 GMT
server: nginx
etag: "596f808a-23a7"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 9127
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 wf.png
csgowfire.ru/templates/game-torrent/images/ 10 KB
10 KB 58ms
58ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/wf.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

da9677e66b7412b04816bfdb3e1a4493c1ff46198b1b67511de10425f14c1db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:48 GMT
server: nginx
etag: "596f808c-26fe"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 9982
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 1702131383_whsrs3.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 26 KB
27 KB 59ms
58ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702131383_whsrs3.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

fe61c169cc9eaf9837294b5ef607b82a6dd5fb7249ac6fa88a308b9fca51f708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 14:15:35 GMT
server: nginx
etag: "65747687-690a"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 26890
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 1702129510_legacyfns1.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 34 KB
34 KB 71ms
71ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702129510_legacyfns1.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0ec066587559bd366b94f1d04417997b780c11738a2059ed04b795917c9704a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 13:45:07 GMT
server: nginx
etag: "65746f63-88bc"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 35004
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 1702125142_screenshot_38.png
csgowfire.ru/uploads/posts/2023-12/medium/ 172 KB
172 KB 74ms
73ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702125142_screenshot_38.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0bbbd6aab32bbe175052ebcfbf9a4dbca405c36c10c0917d4788afee96a91924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 12:31:29 GMT
server: nginx
etag: "65745e21-2afa9"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 176041
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 1702123667_neleic_sdyu.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 18 KB
19 KB 114ms
114ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702123667_neleic_sdyu.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

82a380c3067da3fc11fbd3dc9cc83d07fb299ea449303eea2ef63c1ca025f79e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 12:07:09 GMT
server: nginx
etag: "6574586d-49bd"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18877
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 jquery.js Show response
csgowfire.ru/engine/classes/js/ 84 KB
29 KB 115ms
114ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/jquery.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-14e4a"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 jqueryui.js Show response
csgowfire.ru/engine/classes/js/ 92 KB
26 KB 114ms
113ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/jqueryui.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

00c58a2a9ac9ca117e8bcf3cbf4abccfc3e6ed5d290a418472868bc99d037b63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-17080"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 dle_js.js Show response
csgowfire.ru/engine/classes/js/ 30 KB
7 KB 66ms
65ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/dle_js.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

d04ea94beeae5f5242d38763ccb0414f605ff15cd268edcf995b918c21ee1fe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-7630"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 bootstrap.min.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 36 KB
10 KB 70ms
70ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/bootstrap.min.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-9004"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 libs.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 2 KB
956 B 66ms
65ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/libs.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

7200fd40cdaedac3fc077156991ef36cde3bbb8d0ec67a828a6c76e93a3a334d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-761"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 slides.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 23 KB
7 KB 125ms
124ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/slides.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

e0e2bc4e1d3ee5024c4e1aa58a6cad9aa42fc63a8c89ce18013a1c8f2b94875c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-5d52"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 jquery.cookie.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 2 KB
1 KB 123ms
123ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/jquery.cookie.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

a04d373be23a3f37dfe1f88cab01061db75f716edadc6451c652fe538f4be6c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 11 May 2019 12:30:45 GMT
server: nginx
etag: W/"5cd6c075-653"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 19:05:44 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 204 KB
71 KB 228ms
118ms Script
application/javascript 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

43921e4f993f114268cd47fca552c84f2398b82ab32ce097dbfbfe106a6c3e4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-11844"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 71748
expires: Fri, 16 Feb 2024 20:05:44 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.8192673295291188
https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.8192673295291188

237 B
723 B

45ms
45ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.8192673295291188

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

82377b2d5dbb1939418333955429a5c804804ca570a8fe94c4e4eb5792d7dff6

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:44 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 237
Expires: Wed, 15 Feb 2023 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:44 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.8192673295291188
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Wed, 15 Feb 2023 21:00:00 GMT

GET
H2 200 code.js Show response
top-fwz1.mail.ru/js/ 44 KB
19 KB 236ms
59ms Script
application/javascript 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/code.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

384d11b1b10a5836bf06f7b8f893cb49986aaa44d296510c250e72808af39874

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
last-modified: Thu, 08 Feb 2024 11:29:28 GMT
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
etag: W/"65c4bb18-b0f2"
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=3600, private
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *
expires: Fri, 16 Feb 2024 20:05:44 GMT

GET
H2 200 top100.js Show response
st.top100.ru/top100/ 122 KB
38 KB 204ms
57ms Script
application/javascript 81.19.89.17
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://st.top100.ru/top100/top100.js
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 81.19.89.17 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: 9e32b3e7468041792a79afb17e71e9375b1319c03ace7c8a1b511164a5265197

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2024 13:22:15 GMT
server: nginx
x-amz-request-id: tx00000000000010248e2a7-0065cfb075-aed0c74f-default
etag: W/"98beda959dac7c352379d397f17ea310"
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
x-rgw-object-type: Normal
cache-control: max-age=3600
expires: Fri, 16 Feb 2024 20:05:44 GMT

GET
H2 200 luxfon.jpg
csgowfire.ru/templates/mehasha-cheat/background/ 527 KB
528 KB 123ms
123ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/mehasha-cheat/background/luxfon.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0e53513be2614c96fc5198c93a22a25d9ab13e6f2d34b5e1fa6fd30d963bbf0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:51 GMT
server: nginx
etag: "596f808f-83dfa"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 540154
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
DATA 200
OK truncated
/ 198 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8a29a2e2406de60fe661af13cf8acbe533af5c4489a8fdb6fde742c3689b933

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fontawesome-webfont.woff2
csgowfire.ru/templates/mehasha-cheat/fonts/ 65 KB
65 KB 114ms
114ms Font
font/woff2 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/fonts/fontawesome-webfont.woff2?v=4.5.0

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

ec2-34-252-225-209.eu-west-1.compute.amazonaws.com

Software

nginx / PleskLin

Resource Hash

ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:52 GMT
server: nginx
etag: "596f8090-10440"
x-powered-by: PleskLin
content-type: font/woff2
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 66624
expires: Sun, 17 Mar 2024 19:05:44 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402070101/ 406 KB
138 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9323971679203656&plah=csgowfire.ru&aplac=true&bust=31081078

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb9cb83694245674a284da4f3994c61355f73429befb6dafacc5f3a6588408e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141207
x-xss-protection: 0
server: cafe
etag: 15830542011406812793
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:44 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
496 B 220ms
62ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6278bcb424579080121d10686508731ffba5466eccf0464b8f188c12797d624

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RF6kZnSmFrfDLnjyqL0XlEAqsRkT2Xe7SVfENJ5zWZ5miyrf33rJBLc%2FEm5KlTv9OQtFqpS9T3aN3%2FEWmFNCZPYD%2BzYGiRXZJSaffKMJRi%2FITqrvzQ001bj%2BVPRcAnmdRY%2BkY5IO3CAF"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85681054a89a2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H3 200 11gku.json Show response
newrrb.bid/ 9 KB
2 KB 204ms
48ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b6cdb3c61aee105648e67a901ecefc78eaca6e1d50d1ba8063ddcd565ee550a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TqrfCvLeUui3I3zIoqIYBKg5lfr6XrBj%2BCk8YQuu4r2Rx283peSCvJWJ7tqIVajR4dQlodtNLMxd4gNeTKYSwjDnONgrnnq%2BuG0B8%2FBTfA3JxDdrTupLfP2K0cI3oeldmDWr6AUr%2Fd5h"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85681054a8a32c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2

200

sync_cookie_image_finish
mc.yandex.ru/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10281.SVMZlI3xis_B4LMEAgMsgfoKkQ6m4F5IsgKuo7YU5jCfw1Z6jHIew2Xtsu5wObtu.dyTAnD0h3Y4sUXvN4mrI5YlBIwU%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10281.zD56MXWIwuxCvg7VESAY7i7b_oIOTpgm-LPfF4Xiohj2bu_uxAPTjyDo2FOavEZt-l_nwFdmtLL5dcHCS9IrH4_vE5kzwDaEBYCKhM47U_JcuRFjwNAMVTX8_KnoqOU_DD61Xw8Zao...
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10281.5dc8hqe3049Vzn8dcPf0BIMJqoLsbhkjmQ63tEOutJeP8F3xMWq1c4ZHnWl5Q6FKy4Rz8fCSafHvNoJ-Uh4292X_gPXoGh_Th24deXOvvbjzV...

43 B
583 B

51ms
51ms

Image
image/gif

2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10281.5dc8hqe3049Vzn8dcPf0BIMJqoLsbhkjmQ63tEOutJeP8F3xMWq1c4ZHnWl5Q6FKy4Rz8fCSafHvNoJ-Uh4292X_gPXoGh_Th24deXOvvbjzV6n_60Mo_BuXINwIg7o0-oieyxlyzIrj8SEF8bbF5TjthKz-J9djPBo3NfyKYeT9wnH6Cr0AseOQdqH-rVQdfT2aDIASnk9aIQgKl-R1iQ%2C%2C.wJJoyLOZfvvfB70ltqVTBSAF4ZE%2C

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10281.5dc8hqe3049Vzn8dcPf0BIMJqoLsbhkjmQ63tEOutJeP8F3xMWq1c4ZHnWl5Q6FKy4Rz8fCSafHvNoJ-Uh4292X_gPXoGh_Th24deXOvvbjzV6n_60Mo_BuXINwIg7o0-oieyxlyzIrj8SEF8bbF5TjthKz-J9djPBo3NfyKYeT9wnH6Cr0AseOQdqH-rVQdfT2aDIASnk9aIQgKl-R1iQ%2C%2C.wJJoyLOZfvvfB70ltqVTBSAF4ZE%2C
date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
475 B 70ms
70ms Image
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Fri, 16 Feb 2024 20:05:44 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7AC9 317 KB
92 KB 723ms
700ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&adk=1812271804&adf=3025194257&lmt=1708110344&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=164x945_l%7C164x945_r&format=0x0&url=https%3A%2F%2Fcsgowfire.ru%2F&pra=5&wgl=1&easpi=0&asro=0&aslmt=0.4&asamt=-1&aseiel=1~2~4~6~8~16&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344210&bpp=2&bdt=276&idt=211&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1084963335960&frm=20&pv=2&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=230

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9323971679203656&plah=csgowfire.ru&aplac=true&bust=31081078

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ef71e44ba1e7fec76eb1a8dcd90958f81299a7b2fc9dbaa1f146896e114a601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 93829
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dyn-goal-config.js Show response
top-fwz1.mail.ru/js/ 3 KB
2 KB 61ms
61ms Script
application/javascript 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/dyn-goal-config.js?ids=3016302

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

90d4798cfeacb30022d6f8efb927da957733d8302ed75b0691a9c4afc8d9f15d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=600, private
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *
expires: Fri, 16 Feb 2024 19:15:44 GMT

GET
H2 200 counter
top-fwz1.mail.ru/ 43 B
1 KB 60ms
60ms Image
image/gif 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/counter?_=0.8783780858921901;id=3016302;u=https%3A//csgowfire.ru/;st=1708110344260;title=CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5;s=1600*1200;vp=1600*1200;touch=0;hds=1;sid=41fa734848572134;ver=60.4.0;tz=-60%2FEurope%2FBerlin;ct=942/946/946/;gl=u;ni=10//4g/0/0/;lvid=1708110344449%3A1708110344457%3A1%3A44094cb7a539a8649441697c48bbde0a;opts=jst-ym;visible=true;js=13

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 userip Show response
kraken.rambler.ru/ 10 B
459 B 153ms
48ms XHR
text/plain 81.19.89.17
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://kraken.rambler.ru/userip
Requested by: Host: st.top100.ru
URL: https://st.top100.ru/top100/top100.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.17 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: 3631e1cf5fbbc34c769f3c9945db363fd09217b3a6d6730d32315cba9abef605

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
server: nginx
x-srv: 1kraken-prod0002.ad.rambler.tech
content-type: application/octet-stream, text/plain
access-control-allow-origin: https://csgowfire.ru
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-store,no-cache,must-revalidate
content-length: 10

GET
H2 200 usability.js Show response
st.top100.ru/top100/3.15.7/ 14 KB
4 KB 50ms
50ms Script
application/javascript 81.19.89.17
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://st.top100.ru/top100/3.15.7/usability.js
Requested by: Host: st.top100.ru
URL: https://st.top100.ru/top100/top100.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 81.19.89.17 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: e15b6a5399b3a0165ce5553baeb68d5438f0eb9fcc94abd49a54ada8cf230724

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2024 13:22:15 GMT
server: nginx
x-amz-request-id: tx000000000000102491535-0065cfb0bb-aed0c74f-default
etag: W/"1d932fc58e5bfcdf5e65e28466bdf992"
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
x-rgw-object-type: Normal
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 60 B
492 B 56ms
56ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3cf0cb98dea74ecddd4540f5f98a89da2a3782a35769ab7fd8a7b8755f672d68

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JumtWFrE604IHakEL4s0qjSdkJqtWtp1uc1Qj3v%2BhsEm9bkelTPob3vob3J1SZ9IZkdKfS7Ghm%2Fs2nxzs%2BMjoaV80T6jD%2FHObTYigmhe7StcEn2JdBz%2FqXyyhR6H4HHb0L%2BynfGEo3qJ"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85681055296f2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A5CF 22 KB
10 KB 617ms
617ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344507&bpp=1&bdt=574&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c830c49d8de750ac02ead6f2aa890f1d1de5ba66a623f5731a6a3fbc33b81241

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10195
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 149 KB
50 KB 73ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9323971679203656

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb18bf39dbd3f554e754a3335c6eb0ffe8026ee6fbaab986c3e8b03de8592eae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51444
x-xss-protection: 0
server: cafe
etag: 1326434364936543504
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 16 Feb 2024 19:05:44 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B810 849 B
913 B 512ms
512ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=400&slotname=6030359217&adk=2207947559&adf=1824335906&pi=t.ma~as.6030359217&w=240&lmt=1708110344&format=240x400&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344523&bpp=1&bdt=589&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1146&ady=1879&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

168e10b0ef785e94c47475195021957912db91ce80f1312d60606b2c06bc611f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 403
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 136ms
63ms Font
font/woff2 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
server: nginx/1.17.9
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: c929f02407c70944
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 16 Feb 2025 00:50:17 GMT

GET
H2 200 3c2b2226daae872c17c1.js Show response
yastatic.net/partner-code-bundles/968287/ 60 KB
15 KB 158ms
87ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/3c2b2226daae872c17c1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

16c13f0ac60fd3e5c6c568b44f49a7a80a3fc5dcace20789573805149028eab2

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 15041
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "f61632cdfe783d0404d38ecc36f4753a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 16 Feb 2054 01:39:28 GMT

GET
H2 200 37e5f51b4d53831a21e1.js Show response
yastatic.net/partner-code-bundles/968287/ 24 KB
8 KB 169ms
97ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/37e5f51b4d53831a21e1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

31593a6ddfdcfab4ba369674952f6ec9756716cb94ce1fcb9e277229e62385e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7948
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "a73a0ac4cf72516c1448f7b707094850"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 16 Feb 2054 01:39:28 GMT

GET
H2 200 704c5936420664bb22cb.js Show response
yastatic.net/partner-code-bundles/968287/ 573 KB
108 KB 179ms
108ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/704c5936420664bb22cb.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

b9007ab2385a11402abc017721c772911f679ac551cdf1a34b4800226aec25a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 109484
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "ee7f296ca4fdea2df4fa84662a56fb00"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 16 Feb 2054 01:39:28 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 189ms
118ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 16 Feb 2054 01:37:05 GMT

GET
H2 200 1534741d97ee1b3ce68d.js Show response
yastatic.net/partner-code-bundles/968287/ 118 KB
25 KB 188ms
118ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/1534741d97ee1b3ce68d.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e2dbfcc5fc05fe5eeead963a176a2ee330b1d474fa9505ab77b9fceb8ba96fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 24662
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "0f344ba4a7a3e401679473bb109ae444"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Mon, 16 Feb 2054 01:39:28 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
491 B 39ms
39ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86020bbce3f32ed2054fb0cb61c294878de474eb5fb9cb255f41cdf591dee9f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZMgqRlw4v7GTNnLzfptdeQBm5A8GzO%2BqDcWQAcAmt64IJRRWBRJBcQJ%2FAPb4Iu8iG3g1E3cPFsOhEBebZLc5qVgYQWA3nNHURX7Xe3c1CMO6bqPHP%2B%2BMh6u%2Frp9r8qN8g9kAAuA3sRp0"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810558a222c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
489 B 39ms
39ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05a4153123c9b4b16f7b67888bd6a19bf72ad84986f687d94583d784fa8d17cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wxISIK3KYNYzjTA1j85UmLBVasHWQrHZcvOp%2BayxH46ksx8UzRgB402P6v7iZkNDPcAbwx3SkGLTMSOjpt27Nh0E1xWrexFhU1FFNEh%2BlVvTzxHfkit4d1KJxM9JUVI3x8vKS2BZZdeg"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85681055ca7c2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6BF4 22 KB
10 KB 589ms
588ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344615&bpp=1&bdt=681&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84a75c984bedfac8268bd5094873a8df1645ae458629b5a9ad211ea4a6889e40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10232
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A70C 22 KB
10 KB 686ms
686ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02a735a460a0313db4da18a6c9c0501682143feeca20800ed5836fabc8e34d52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10311
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7C2D 25 KB
11 KB 531ms
530ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf0a1bf7954ebf0bc174ee9864bfd673e96993f7f370d1867cb03d9877fe141a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11315
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
490 B 25ms
25ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

520e62f5f66a4ab79da6e39ca77910599690d26e40510dd204801fbd980590fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3jQTkfnBTDylEA%2B7DZZ9QaqFnaTnkZ8dfwmWh9HmjWKL75fawp6WG0V5nYNhwNz6RhtH8ZVcNPj3%2FiB4p6i82odJqfbopTPMcJUgEoMi1kCXVZnD%2FuNCSR1awfWwZfOzwLGaOxafr1YL"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810560b0a2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3FA0 25 KB
11 KB 535ms
534ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4bb2c4b61077e5227e6c1fe2f521dcb572f9e9ffdf22c9537a260ea434bb3a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11269
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AAB1 25 KB
11 KB 568ms
568ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fa14c5851497da7bcae107d41b495f722bafdc92a5cd49cb13ff154a9ebd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11229
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 63CC 25 KB
11 KB 550ms
550ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99d629a3af81ba4144be50c2da3a09a9b236efc25b108b20abd2bac74825f828

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11229
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
490 B 26ms
26ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dac20ed24ba29b9c7ed2221f0fc33f02430fdf775b08fdce35425e9c67ad35e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NbYlqWHUz7scuapFrEpXiJKRCjVlD4uWS2lETMVQf4185kh768AWqXPVWZfBJv8Tq%2FBU1drXvsU3T9n%2FzryQzsbX5sgHJ6jzhIEp6fMH%2FRPbzN9J761ZvGWxiwbynlO0VL0KBuptCwhZ"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810564b5d2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2

200

1 Show response
mc.yandex.com/watch/39385800/
Redirect Chain

https://mc.yandex.com/watch/39385800?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Al...
https://mc.yandex.com/watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3...

501 B
592 B

56ms
56ms

Fetch
application/json

2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A0%3Als%3A523852619489%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200544%3Aet%3A1708110344%3Ac%3A1%3Arn%3A769931417%3Arqn%3A1%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C88%2C182%2C1%2C160%2C0%2C%2C326%2C3%2C%2C%2C%2C761%3Aco%3A0%3Acpf%3A1%3Ans%3A1708110343503%3Afp%3A646%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace%21%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29ti%281%29

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

47745c3d7f6abe9aaef4d76f0842594802b335942849096f90e9d262511b8db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 19:05:44 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 501
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:44 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 19:05:44 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A0%3Als%3A523852619489%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200544%3Aet%3A1708110344%3Ac%3A1%3Arn%3A769931417%3Arqn%3A1%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C88%2C182%2C1%2C160%2C0%2C%2C326%2C3%2C%2C%2C%2C761%3Aco%3A0%3Acpf%3A1%3Ans%3A1708110343503%3Afp%3A646%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace%21%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29ti%281%29
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:44 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BB4E 25 KB
11 KB 713ms
713ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

158c4d4fa6d203e96320d835292dc532d152ffb95dfff3d0d35a2576e1bfd95b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E020 25 KB
11 KB 600ms
599ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17c870393aa2fc8353315193a16ddfc5dd4e74437e6c2020556dda05c074fba1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11233
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B32F 104 KB
44 KB 521ms
521ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344709&bpp=1&bdt=775&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c211eb0547425b7bb8ae15c8ba991d4370c44338c41ce546d93e99e1f1f42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 44819
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
488 B 24ms
24ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e8def5a42d52e9b616f95f6479eac23f4a710daffd58138f8c3a3048bceb3f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jXseaFoOfwseYtulejpzhmKPrwgp1DvZR1pr7NKEyj54Qttfn1vrU6ecFCUW1bWrX%2B0WFSqB9XSAuqHW9LPO45ldRmweNSEp3UCT6g5auq52EWRme5TIpHKdv%2FqqnVkMulNETsJSXNYi"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810567bba2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CFD9 25 KB
11 KB 617ms
617ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c548076048be183a42db3b6dc7f4e2921d57601cf738ae964cd64d8f5746c57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11241
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
kraken.rambler.ru/cnt/v2/ 43 B
696 B 156ms
60ms Image
image/gif 81.19.89.17
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kraken.rambler.ru/cnt/v2/?event_type=base&event_name=page_view&project_id=5753332&session_id=700412596_1708110344486&session_number=1&session_event_number=1&version=3.15.7&counter_type=web&experiment=%5B%5B%22exp_ws%22%2C%22no%22%5D%5D&top100_id=t1.5753332.1357547201.1708110344485&adtech_uid=39462c90-4cb1-4612-81bd-4f200012c189&adtech_uid_scope=csgowfire.ru&fingerprint=pA8AAENKs1cCoPNZAT7WYgA%3D&fingerprint_ip=pA8AAENKs1cwNqCBAVz6lwA%3D&url=https%3A%2F%2Fcsgowfire.ru%2F&request_id=1708110344.485-656743792&event_id=827634476037700&meta=%7B%22title%22%3A%22CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5%22%2C%22referer%22%3A%22%22%2C%22screen_size%22%3A%221600x1200%22%2C%22browser_size%22%3A%221600x1200%22%2C%22color_depth%22%3A%2224-bit%22%2C%22language%22%3A%22en-US%22%2C%22browser%22%3A%22Netscape%22%2C%22platform%22%3A%22Win32%22%2C%22timezone%22%3A%22-60%22%7D&rn=831420899
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.17 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
x-srv: 1kraken-prod0003.ad.rambler.tech
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif, image/gif
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 320707 Show response
yandex.ru/ads/meta/ 31 KB
12 KB 218ms
217ms XHR
application/json 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/320707?target-ref=https%3A%2F%2Fcsgowfire.ru%2F&pcode-test-ids=963061%2C0%2C45%3B948598%2C0%2C79%3B944517%2C0%2C72%3B962954%2C0%2C87%3B959786%2C0%2C38%3B967815%2C0%2C18%3B968519%2C0%2C40%3B968854%2C0%2C2%3B962776%2C0%2C44%3B964929%2C0%2C36%3B966915%2C0%2C55%3B962768%2C0%2C76%3B962785%2C0%2C26%3B892905%2C0%2C94%3B962788%2C0%2C84%3B962799%2C0%2C92%3B962835%2C0%2C11%3B964644%2C0%2C86%3B961173%2C0%2C23%3B940996%2C0%2C20%3B964642%2C0%2C17%3B963892%2C0%2C5%3B965054%2C0%2C65%3B968287%2C0%2C37%3B912287%2C0%2C11&pcode-flags-map=eJy1Wtty2zgS%2FRc%2Fx1neScwbRIIS1iTBAUErSiqF0iSuGe869pbjzMxmKv%2B%2B3SBIiVIC5jKbh0Si3QdAX06fBvPXxTXtdLcRW00LXdEVq3QppOaNXtGmYfLip1d%2FXfy%2Bv%2Ftwc%2FHThZI9u3h28XTz%2Fom%2Fhe9JEoZRevHp9bMDTCtF0eeq06LRLe075kRIfRKFA0LBO7qqmM5F3ygtWcElyxXshLatGyPwoiiYdgFL6rqvFJeiqgCtUfiBSb2lKt%2BwQiteMy3KsmPKjRsGXno4nWRK7vBUDVNbIa80k1K4%2FZPGSZSSCQFWz6%2FAyTvRK91VAv7iL5lewYELKjnr3GBp5ke%2BAcMTIEYrmTnk4bjXvGBC25%2FP4HwP%2FszwSEhSbwFv1ZcluI7Vrdrpitf8FPSbEa9byou%2Ff4dlD5%2B%2FF7XBXP2bd%2FoFzB%2BKz%2Bcx%2F38e%2BN7oY7KvJV3pijVrtZkZQbFmx2aZl3lpNJmxxpCAkhRK5Zp3Pa0GXkFWYi8Ukw08KTo3JWR%2BkHjfAWoedLRkupS0dlOXWWOgBymRZzr4DSAsWFAhmbYUIQC7M6i0L7jQuWRU8euFUs8iL%2FDjaftjkJQAEuoUlQppqOQSFso3fXOlS8qrGWI8j3gWBWlwAKRKYUy7b0EMXYBwVmDdvOIMqLtia%2FAmb0qhtxtuGL25ZrDEkPzon4XTx16WHfFuU0AS0hW6gBaIxDt40MsKN71lK7HkzdSLDiy8ZnDGvlOi1tc1bSfvXtOqn0c8OambLInD5NBoWA4QuaJD0tS0qtzbSLMois6tjaXecrXRCnLxWzDG2NW9gr4GzjhvSfHMnAS%2BlxjzDryqbcstMF3VrmXY9luxZZKVJc8hmPluBnbz53%2FmcLPSpUUxVlpL19BiW8WhKoZCwFQz7q54c%2BU%2BIyHE9rmxnTfMyJOxeDD0rn0R3wNNYBDaXBTsBzE64AWgjqarKLoZ4tbSBk4GcG6ELMmCCcHQAm5kRyGfX2jaOI0DP%2FEPZFpySJG2X1U817QD4dJ9Gx%2BSMMqC5CDUennNdmY3m127gaApN9eROIaiPNgrE2UoxQ78MLMkSezH0cw2SZOEzCSelXZ5J10%2BiIkP6W4MTUsaBKnuG15yiANv4PAlzZkbIwushsMEgMSGmtnoSqx57rJL%2FCxMotmmwVsS0rpRVsdhv%2B0gnVijuxP3n4ER31ZtjrUumpHTSjiC5qbXwJ5owZwZlaQZsZ7E0JUgGZui2g29Cmv3VCm77VdXRn8OqTRwM2BAeq%2BEG4VEtu8hSsWgqgChdtokWZQMNX3ktrUEfVWw7koJ976zJPLDY%2F8ZnoPuAiBHeA0oaug1JV%2F3MD6AesExImdQ7U63pr4XpfHYyIc0Ub1sbHigq0G01UaKfr1xVknq%2B2OjAVIHXv65Zz2DKm31qkLpUfF563t18W5%2Fe%2Ff88QOg%2FHd%2F%2F%2FbmT%2Fj8j9t3%2B19v3s8e%2Fbp%2FZ568%2FXhzP%2Fz6%2Fvfbp4fh47vnR1%2Fe3t%2Fap4g8IcCDx%2F3Hu4ePv9kff3wc%2Fv3wuH9%2Bf%2FPH%2B7Nf%2BNf%2B4d2tMX09O2IMBTXU08CjNZNr%2FLvgVCu67pyeDoPApoFJYAZRAj7OTZ9wG8ahZ7kU2nfBSgqMMLSZpq9XzEkkaeyHVpmaidTMlNigYMhl%2BVA7oAo5VPkCTOrFE6HTokYeWRty4EVJz8M781wWx8RS6KzWjjNYiT7fDHlcic7scOjwkv0TGHMhj6FMokE37aDZQHjywcWrSkDyQa2BHFPsM1koL%2FllEBEftPmlD5DH34OT7%2BHJ98h8p5dBDHNGGlh7ehlnWPKXvj89SCB5Ulzg2C2ZRxJ%2F6Ewlh65Y0Nak1TAZ92un%2FoBOE0dH9YbSjteYFBigIUGdALEfkQGg7CCYAgYA%2FsJtEYaWimz%2BQ%2FbiOIEMSI2KxhsHaMxQEk3vhoqIVRgbKgsjVAaUDhJc0XzjtIZaSpKpsa1bpSGHeKuWjMi8q1mxnqP8Rxk772SvCMGKT4NnBA4eeWHyLAkJ0GUYz4KYhV44%2BdEy%2BqguNSSdrilKS4iMW0%2F6XkYWSsTo%2Fxw1jzCFgqpT8vUGPoGirViphgGOArEsLJYEvnVgL9EJmDlOGkKbLJwYwGbAeihdjLnRZk5d53mxFVJWKo%2FDkWgBRKoVdGKqoQ%2BVJzU6RgLQxljMCol4QUL8aW9DGax2WsImhb2NWyNRzU74KoQZ1vfIHAlEkzdGU7ItZCcbBgS3ZA08b6Afq9R4Y5ZExqWVUarGX2IFSgrODNQGm2Nr54wBqLG93LOiaRLTZmTC5MdhtjqVsGc4YRAfBtbpfhPgUEc79QfYRnE2v6Q0osCIDazYUxV8BhCHNm%2FQGSPIOHli4RUi72sUl6NTJje5gXFWdim6ElhNLk0qwN3%2BUt0h%2FnRTYLolr7iatunED704s2PnRvRVMdxVGR8O3hyHMqPLj1cFLuHr5qBO1Xpe1Pu7O%2F3weHtz%2F7R%2Fun2412%2Fubt%2F8e%2F%2FL3c18%2FRCGseP1be2dLzSTwqeLnR1rgi1ejh66YhVTS9ngZ4EdiKyQgSyAuDMYk0%2BL5cjTU2awF3nVQ7eoJeXuwMIMY%2B%2BRhs1BfxBXeFrc77SoGyL1yGHGNyMjEC12DhjkbR2Y%2B61C9c1CGqSBLSNzaYOKBHJpw92MGaZQfROvmUkQSAmkdWfainuKj0CUWHWh9Od4kUpJ3QQU%2BWk81K6ZOBtT7XiBOCgsM7aZFyYLUyCJozTIPgNk5%2FqWKmfHP7I%2Fkp%2FjVdbi4klsGejoQpRjHPEcvZEcLD8jsrOLgCiDkXqYycUKL%2Fe6YjYK4z0oNzT9NU2YRBGI6mlbhzKwNxQFlTh6sdqdWElA4kOOWlvrmC2rgMuYHva3cMtBUstTtIBznZIvgQHaj%2BcrmydjgeErNKwK1DpS1M4xmiSgPoltbLXAvljZS2Pgb7Aek3wG8ubp7gQksyc3c2vdHinoK36klvDHMBCfUtMZXpCmyVfgfSUIJmouKoHjuBRb6NuS0%2BbkSA93D483by%2F%2FuH367RJG0ctfPjw9PdzPEUEqk88huj08WY3XkpLnzDR%2FGBeuFpRaAnIqdrhiIyR%2FCVr%2Fm5ybZF%2BFuJDtbhgoy2olQLQtoWSu400oXzrdlwFHfbPlBSg0UMSKN%2B6LgQwC5bl20%2F3cA5cseTdzuWUxW4KUHHIM2K0UL%2FA1sc5hFFtaOgsPLcqI08Mt8fgmuxt130LOJvaq0LKCFXQDIXQt0CvDK1C1c%2B%2FI99NwPmYcbq1NIzzRvLO7ChJ5hCTzA6FDf%2BRQg4an3a7J7b3Y6QuTszOEkBZnVrD4cFNqrzUOL%2FjdW5jAOvxPAD3%2BhwAjWw7QX2l%2FvBmc12ragKSQ9j3Vd4BwiOb3HoYpukY1AwO8uOILWRp7tlcYqw2jp%2Fv9soV5j3LeD7MgS0%2F6ET759PrT%2FwBd8QsI&pcode-active-testids=963892%2C0%2C5%3B968854%2C0%2C2%3B965054%2C0%2C65&pcode-icookie=1TjWsWvgydEsR2J2fslnFRoPjbRgcIFRPLZlMMt%2FrqiZlu69fLQXbWn3vwkS7Jv3kKFEBWXsbeV1%2BwlPyJz%2F4hlqHn0%3D&duid=MTcwODExMDM0NDM2MzUzNzEzMw%3D%3D&imp-id=87&charset=utf-8&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=333701779030018&ad-session-id=3365011708110344773&target-id=10880242&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fcsgowfire.ru&top-ancestor-undetermined=0&pcode-version=968287&pcodever=968287&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A160%2C%22h%22%3A0%2C%22width%22%3A160%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A0%2C%22top%22%3A0%2C%22sspInfo%22%3A%7B%22deviceSizeSsp%22%3A%7B%7D%7D%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=5120&grab=eyJncmFiX3ZlcnNpb24iOjJ9ChKkpJDkOOqBEFDnDjb5tzZt0I7zunmVB3lZSZ7YigWbUzdqu2cd7duapIJtO9tN3jq1YuvOo9gV0hes_rUdpdShAD0RwBVGMhETjVZ0LMnXpfvxNiJmzMyYQQxiNHNZ6BS0WmYWuiTVM7ModAptwowSPmpkiEwVpSpWKpHrVImpwktVyFNDwlkDQAShT1GNNZAEgkDqk9UgrIEoED5QggcY1YdH5csHOAv79GOhTRRp1aS0CbhmfaI0qHRqhS7WmKsh1igSjQJcc0AcCF4gRSALxM339yc01YDYp3qQoge43DUsqEH4IKJA8CBAfrF4HmQQDux7Un77KMB72EB4CAQNCfILFD-AokD2ja6d5JkTiH2Sp3dA4FPVpkNTJy-9md1JcTgJNaxYpVfmdD_p7FM3xlhPzcyi18FeAFaDNlUqwTWftFSnSVRmJxxVDMtsl6g10uqN6B9WWmBqY_pYQa1OHiZ7-gB5mqxgdI62yiRVGegY0-OOIVbRPjNpFIpYwwvByKjQvGRdgc6QVobUOFCON90DHFEPetoO67myG8MLpdEWeJoUtvGprzvOtR7felWs1sewNBnFPGlGGuXV9QnFB_2IoQ5FtLprz8yiVKce1el0en2iMWp1GjjVFaBK6HVKxTUPQFwSif754f38QYT7VMKHQeGTPkwSFvZr1_yz02gdFLRTCttE9eyeQvDCNN65VwZvDVv-F0-bqpVJLaBtNTu5D27GpehPDZD_E7KnmPCp5aAczuKAD4i-ul_hEVV9yoDQJwnwfVIst74UOh4uFWVYEhcOAQdCn-x32ie_qffJsNwa6jOF3wtOsE2jTwrSbhfw9_sEyzhRILI3Aah__7Ok0qaqexwjK0ar1MBwZGOEqTSysdqTSKdPvPtanzo1GH5_f7iMOo3HN5vZQrIDztMt0TrgXjW_nCA0iV5JQft6_NB9_Y4Ifpu-AnKrfJhP6TRmt873pyHgdEiXuYfigvm_tQaA7DUQThevCFlqWAuaSfGWBosieymwJfYYxqTSATHWpBUBwoqzSMj_jY-2mL-mkn0Q_1pjwlJnG7Uu3kK46MpaBwpiFPA4PQG4dkYGNlNFVxFp_vWJ1wzLVQ0A-xlL9KX_SOVTchdWooX0SQLii72SflHPfScsdMI2p5A2Egi3KjIfDJz-6_ntuRMNbE-LECygIYMQziD8dwholAorCQO3RWcOcJg5jyjh546y7fDWrFiyk38KSK4kfMfg-KD34ByXOLDV8yixwl5n53YLv97AtvP4eyGw7A0hURrXXjYPK-TyLlw7g7h8RZPY-B9I5PtAQlw64xYQ2QF8wfdeyH_GPD2-9MIx27EfinFiirN_xqTxl3JosGNFojS-G_SkLbv09-z7q5bYl_vkPowgQmVv8oSeMiZa5qwuAzuTVyTPKHKD4F2Om_QApDZK10l0yuQt6FCXMX7vgdZRincDjPSqmEZttpn4D7keJOUJ31t_9gluIP4DngvjfbcY-Lj3xqpkJ-HxGOO8tGPUxgY4cA1a3ZucSrj0b1k66DVWeQCYJTDyYcPtjPiJ6XN6ZmnJBjVPj-uo_IaG75GongsPNFfLd009uCpGS8eAQQcz0T-RwzRbw3n4Zhyb4lb3dtPAs7lpZdmnaK6DeUHn9tMWeXcfnWk3kdpS4t898qF_Tke3dtwlSnbPRFOSHcd3zwIRr0TZcwfGuF3jjKXOce3T9xNtVLCyWKwdlH20kfZdieqCMsaGJC3wYdHpFElVp3q9TkNvtDkQHse8fGrpjei3CEpaI1puHgJdrFIoFbGKmisMo442pd8vptxtgVxSn7swN7W0Xm3u87nrFR5SI3wmsJkQI8p5VzMHUOqqnCXVl68H7lOO613M_o2NTy4kbSKenULK69jnhqRDMf1AlotvT-GyvvkM30P_y1JufqHL3fL1XA_U9T_mE37jZ-7FHogvnKJEofD8rrMG2vEttrNk_W7JyQyrD-p1RV0R0sWJRgdz2IvybQzF6UcBtwr9i13SvdVRGa8Z7WA4Xj0qbE6f-48_K3d6U-GeJyqh80SeLyQdscJd3nDBoH0ShwEeC7saF5Lx9iMzhXII-lTxU1gxgveH_DuxYiiZzV2CIaalvUV7weCjx1jkpNbSaGPVt2klY4_YOQ9nDEf5iXEfWwDpREf-QjSXBdyTnHh1ttI96ZHPC74lrNsLxoG645wuOjyvce8CDZckd2S-LasLe02W-Y2h5LfMvQtSRCgQIwGzgoMCGRNKIN1lztCM9lvRnvH-9Qldn0Wj9bw0x6sj_f0ACp-qvq0qX_sUtINoOup-TPtXkY_DCzUADnMA-A9YxJgeGihLJ6Kl9uco4hhBYoh1WswP_TYh3HyWThjCxHFGnSzAXwdnBS9T1x2ays5Lw1JdOTCW5mjZMAAgzT1jCNdUD3cRKTbN3xL3oZna6vVh3I0Enq4unMo6k_s43OiMvVQ_NlulO-vwFbWSn9KZkllmL5WZwAEHKRNKoGJGAR8hpstqgB80npTiNgI3BPhnjGzoo9jp_83_JCYcS6jQ6mC17S5YU-X7Rcsw_NoY6s-vaT4stPMl7XwqjQXdWFTsW2Aww9FjZANgy3C8guPpaSL_htxzHKQ79Gr1w3ZjM6d-VPi3gcIO3wS5LqoooLlG4wPndimPwSbeBD4G_e6AZH3J0RzKvCs6I7vIGdnvfPao_p07eS2yfBy2FtOzP7RZ_1Yy4qR1302wRxbeZhdWyE3Fx2ov8SQRLdfRlQhiO4IlWG4EFh_XTQuOCowlNBsagFjEtrKAP3_ZSv6ylvxlfSv5M96oViWwzVzSkA1jEYamCENj0xpfZw0NLWOiUhatvjv2zKzLlJQZQ4OhbzB0DYa2wcBvMDQNBl6DsWFc0FmZNClsuAnMTzEODo6cX1a0vPXFctk12w3HwR2bw8Dw0ujYBm82ugjM54l_k1x2Q9agpI9hMawirs0YwjdQoK9R3kMdFi2eTbd2dyhYDizszwML9vXwuRpXzWzXXAgeXDxaC3fmxxp-tm42XfKMedrq_7_b7O58jKjxAETVps9fvc7k1-7jD7hpbckXHBZsqHqGIqBXHNkh2m9cptHN3BTibQIJB--Aw4svF3tuqcndWgpnqp_9rZyvDUo8rKurptqodBUybYMfSc8ArS1C6urEndGE4_QcpwAFvSwk35s2GD4pqhpAycy-b4t3bg6UABJnY_kvpccTlvSELsdntgiPqz3uV5D85_COS2K6qTtV9TkRS9aoTjMgq0UB40N3zRDpLMps1KhbiI5erW8RPqkNndZ92OH5Fks4hajW9ebcfftLQ2pE4u1iClbZTO66FR9rl_LtpH6Tq0V7j6TNgNBR68OxWflGHsWGqbz0qEW5jJ0kFhXSG0vmBk92wKO6RH_fEqy-1nvqHqSQIaH7L_FYACto9Wb4o_88Po--_CtDY4BBW5n267oV6rNDnQ_uJQgLpnjJnYMn3XCVveHlUI5R-6w1Nv6naHymyJaLHOeWRxsu19MXr-a-DHpUW095gWMxZyeQrZyrE_5xsj4-tOWP93j3b1kt2E6LE7-Zj9-olwu1STxd76p8z40IK6phbmHV_piO1Rtm1EvAfetoWblOgWlc99HaEM0WL-h7-a8kq7up1s8-rkCd4Zc2AYjX8rdjPItylLX8LSTBkOrZ8e2yjmpZXEyd61Cs7uKP11GOHhF9_i49ZizxXKt45zvqKkdlb8nGpyBqcn-SfTID_lhVdm5WlWQI2fUCvr5LtPxGvd7uoMvIjcRUo6A11cHU9aYkH9NjP27FtZ6HIHymQS5bLdodli9xCg5XqrrqyDGMo56d8RkX9J59zcPdzWucJR3e-HynsW9FxBZI0k4deXuPhNccuIDYfephTdx4UL5UMOZCHrJ6x7W97254uVSSX2jiJc4t_G6-fNw61xiKNmxS5IMtXM21pDdTMnGXsmfOuf6DHNN5giUa6GtTOd0ZwZ5PPHRjZA5AqVOKCfeoWdgZPY0CExKgcAwWU_sp9_QNLEe3v4h0X-4NAMkQN8Wuy0boD0kEg3V8pefw9BDwUq0WaWqA09Z-5Hzu6Etziym05juL2k0TfleQYgM5CUeHUZcU5A8XUNl9PS2rxemtDjuVkG49v_glwVcYRUY55Frqph3wbdcKy7RDnBKLd5jaTea3tb0IqyPOHPP9rjqJkav8j-35FhSNOy4pONu_RVobYMzfXUlnlrou3lNgg4aXy9LdUM-Hu9NBdPO5FZAlHJ3_D7313rzDfezwMpm40aMRZXgl0d0sy9tRnF-zyP2eIN_cyWH841E6t_Ap2g3a-dhQOAtnrfHbJpRT8fbzJ3B24FoSoNqZ60hVNjgf3XEIN9-K-VLy5VyQCyr2yrd1tCkmaxJd88ur4N4IhKMW0Wz-GTfjfu2tBndrWFnIsJj2-bZmMeUFXFQ5YJ390Ub-CW3eGPtyoL9EYYkYzgU-sj8vl6D4vBfO3dMT9wBFi0Jf5mo7SzpTtGJdWILnRUT-liuPNUuSRGO8d_wWN-NlrnMsKDVa2_dwLi5r5fs41_1cAiFxhRJd-HsHRTbYeuNY3KZvYfBmmsf9s6nS88zhu_TqiR3q7fDeEAVRL1exSlsDXWYF2kQrfE-jV7Njric7sISN8TpIZ88IXoLzbFZUYyOXnWm3KXJ2vK8u2qii8h4rs5DTOuAODN3einI6Us48IyT3bg8NmcBaIVtUUvbTXYE8soHkqFkJuGFZABwd0WjMtnsM_hi2Q-M2VVFNf8Jmp7Cr5npt03i90cJ1VNv7KLbgEt66TLZ5H6tkMNvaMbi5hzFuzXhFBONeW2MiToUyl39yIuLOPb_QryO5zT_ZEOaMRAtk3IJd2fvWWP9jAJJ99SXj24yNV08lKmxM2mXOWPN4zc4SRwsm096XYN2hvegpNjaTxGeYvFgoA2yOVgz_-467rUQ7sqKSWGvoPN-czsW2jPdcNGetD5HWJkyZ92URFvZZ6OXYGEMbEVYxJigKdtcT5ufHdiL_dhBM51A-4NmGhE3i5F3P0bc7PMq1d7lWf30AT40wAUWy7JLNSZxYIq1PsltrTQ-qtZ8p-y6LyIRscEnycF1QV45TkZmH&uniformat=true&callback=Ya%5B1036713625097%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

d7e75fab955f4fd123203b2ca0ca1f1ffaedd069327a7194714d8b7f03826c7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110344809229-11298614648959560492-balancer-l7leveler-kubr-yp-sas-218-BAL-4839
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: MediaCreativeReach
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:44 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
uniformat: true
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:44 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 60 B
489 B 42ms
42ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1e6adf9fc53fd6576c2fdf7c760ad04dc3be29c77cf7f82edc9db3c645380ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O6jmX9hysB8KDVdPQI0aPvh1XuknCMTPA59EcvpsG7SJX%2F0ozluaWLtNW58zUS9bdrbTbqZEod9EWQCB6xKgx6pQwYRn9ME99CtTuQ1a4wQx1Aa%2BYzvy9ef0Q38FmKUjXGbPTPjlKBy7"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85681056ec5a2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
495 B 23ms
23ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

827c84af8d32f3b9b7a790ca302b4b6bc822e8c3172860f9c603fb222019fd99

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1%2B5Kj48jwgOV9yc1AAGU6iBswCHJZ3S46UbkeK2MzdE181h%2BQJJEYyYKXIhZUcj1UGZ%2BZBp2aOzsmSjGe0GGeV%2Bt%2BMLyiwGT3lC7tHS5BCi3hqTDAuwfVPxYYk%2FdPtDyKIjQq0nAXjWr"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810573ccb2c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H2 200 1
mc.yandex.com/watch/39385800/ 43 B
86 B 57ms
57ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/39385800/1?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1708110344_5b029783906d00db2024a88f030bc46370cc01cc0cfea0dfb60dfdaf122b2495&browser-info=pa%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A1%3Als%3A523852619489%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200544%3Aet%3A1708110345%3Ac%3A1%3Arn%3A137617652%3Arqn%3A2%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1708110343503%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223365011708110344773%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 19:05:44 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:44 GMT

GET
H2 200 metrika_match.html Show response
mc.yandex.com/metrika/ Frame E9C9 2 KB
1 KB 69ms
69ms Document
text/html 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

482625f9d55feac9a3187b21e5a8ac098bdfaa328a094f7b4dd2d24ba59056e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 862
content-type: text/html
date: Fri, 16 Feb 2024 19:05:44 GMT
etag: "65cf573e-35e"
expires: Fri, 16 Feb 2024 20:05:44 GMT
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 209ms
53ms Preflight 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://csgowfire.ru
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://csgowfire.ru
access-control-max-age: 1728000
content-encoding: gzip
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
timing-allow-origin: *
x-xss-protection: 1; mode=block

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
52 B 161ms
60ms XHR
text/plain 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 320707 Show response
mc.yandex.com/watch/ 411 B
518 B 56ms
56ms Fetch
application/json 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1527199428942%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200545%3Aet%3A1708110345%3Ac%3A1%3Arn%3A321215744%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708110343503%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=mc(p-1)clc(0-0-0)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

b79bcf679b03ce6551ce9978a40e6173faa3f074442e1bd1e9b0b696fcc3377e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 411
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:45 GMT

GET
H2 200 8569481b-00a4-42c3-a836-9f6cc9cd9e43.jpeg
storage.mds.yandex.net/get-bstor/11410598/ 128 KB
129 KB 217ms
102ms Image
image/jpeg 2a02:6b8::158
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.mds.yandex.net/get-bstor/11410598/8569481b-00a4-42c3-a836-9f6cc9cd9e43.jpeg
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6b8::158 , Russian Federation, ASN208398 (TELETECH, RS),
Reverse DNS
Software: nginx /
Resource Hash: 7418245e3998e544b8c74e5e60bbacf6570d3f0a4ee61e3cf2770b523cc8f54a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
last-modified: Mon, 05 Feb 2024 12:42:53 GMT
server: nginx
etag: "60cc1d243e263c7b55adc043c22e8bf4"
x-cache-status: hit
content-type: image/jpeg
x-data-size: 131171
access-control-allow-origin: *
x-mds-request-id: e86366a2600b04e9
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-robots-tag: noindex, noarchive, nofollow
content-length: 131171
x-mds-tvm-error: basic_auth

GET
H2 200 render.html Show response
yastatic.net/safeframe-bundles/0.83/1-1-0/ Frame FE2D 24 KB
7 KB 101ms
33ms Document
text/html 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html

Requested by

Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.83/host.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=946708560
content-encoding: br
content-length: 6262
content-type: text/html
date: Fri, 16 Feb 2024 19:05:45 GMT
etag: "eb77de48712912aadc9aa8171ac75ede"
expires: Mon, 16 Feb 2054 01:40:41 GMT
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
server: nginx/1.17.9
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow

POST
H2 200 1
mc.yandex.com/watch/320707/ 43 B
74 B 57ms
56ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707/1?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1708110345_aab2e2bd7e49d02a6da31cf2829df670d4adafb430ba6c62301e17c872cc19ff&browser-info=pa%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1527199428942%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200545%3Aet%3A1708110345%3Ac%3A1%3Arn%3A895261838%3Arqn%3A1%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C88%2C182%2C1%2C160%2C0%2C%2C326%2C3%2C%2C%2C%2C761%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708110343503%3Ahsa%3A1%3Afp%3A646%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345&t=mc(p-2-h-1)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223365011708110344773%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:45 GMT

GET
H2 200 320707
mc.yandex.com/watch/ 43 B
0 60ms
60ms Fetch
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1708110345_aab2e2bd7e49d02a6da31cf2829df670d4adafb430ba6c62301e17c872cc19ff&browser-info=pv%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1527199428942%3Ahid%3A854193272%3Az%3A60%3Ai%3A20240216200545%3Aet%3A1708110345%3Ac%3A1%3Arn%3A382247989%3Arqn%3A2%3Au%3A1708110344363537133%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708110343503%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708110345%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=mc(p-2-h-1)clc(0-0-0)rqnt(2)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 19:05:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5CF 42 B
63 B 38ms
37ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Aa78U3Zm46mx5SAtQZ6cgNTYma24_8LQV48PjSht6VvlSQyG1DabcfdGpGlF1FInI_J36WIh5PAVocQHQm-cnMUngv0EKBuMfNcEDrfEuCQfU5CE4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344507&bpp=1&bdt=574&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A5CF 93 KB
33 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame A5CF 3 KB
1 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame A5CF 20 KB
8 KB 32ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A5CF 204 KB
61 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D64B 624 B
508 B 49ms
47ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNWYmBawVOXWZfjOgtuOZN7IpM5mf2fHCVbJDzsUS4rePsFobE8_wke7lc5JpVqXc3JYZ1UyEkvsNqNLRw3kxxzYzGjBNY8GjJS5IyZz-6xjNYFK3UKl01fgBH6GX-71NDrcAe8fUknfZstkSF8n3ilFn_Sx5qsiCaPYlkBjGP71P1O17lY

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344507&bpp=1&bdt=574&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
492 B 26ms
25ms XHR
application/json 2606:4700:3030::6815:7e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:7e4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c71e5dba7fe16b5749836476459d18fd817a81f1da29131ddbb9c996941809d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7qSRFxj6E%2F41LH5pzi3P7%2FB5ChbGtsEGEe6ureulWj9iasXzoHcJVEpGApzSqRCDGCD5jqPrJ5Ly3E%2Fx60QCNY%2FMhHiS%2F1dDlNR8s%2B8hLTxxTk5uo1ts4O5xC5E5aAQC%2FcnvyuCJZFzG"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 856810592fd02c63-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H2 200 1IrnRuaG0cG200000000U9nJv9ZNyhXvpJC1mzS2EpMVpzd3OScnwNmg0n1umaH2kJRV38uz_8I58PKHA9xvMk2l54YyD1p8gsK24gsC2K2o4oGB14mCCncVQaCu2nabeY6YAnaZv22iZI2f3Sn0OY-ZWnC_mr6mp5b6aCXLHf3aNKO66GQ6lun-kedESvb0DYnbM...
yandex.ru/an/rtbcount/ 43 B
1 KB 56ms
56ms Ping
image/gif 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/an/rtbcount/1IrnRuaG0cG200000000U9nJv9ZNyhXvpJC1mzS2EpMVpzd3OScnwNmg0n1umaH2kJRV38uz_8I58PKHA9xvMk2l54YyD1p8gsK24gsC2K2o4oGB14mCCncVQaCu2nabeY6YAnaZv22iZI2f3Sn0OY-ZWnC_mr6mp5b6aCXLHf3aNKO66GQ6lun-kedESvb0DYnbMW0arp9503bdcVu3mIicWUlJNjzzBS38iEjNM5wB81l3NoQG4QtCh42obraHI4vbvW2ISvb1Hgm4aWeC8Fv6PjT9dvu5ljcaTv8Pvl-hp62BmUHJvWbxWtb-CeCS1_O4oyENwy6i7InC1rZ-mm3Z1PQtJwyUVxTozYtncomGptsmVyZowxdAhpc1L-tVie0yje2LyoJhfBryOEaBh0etMJcODlyJEvHayfKLPCelLauZ0pCBGnCp0ui6jWc_poLri3MmJ63hs3Dfphu9gpyBp62xSZXu0TlBXzk_Jd_ufhkPSIKRp8O3R1uds9WViV6Q9xfQcLRwXfIw6XMOlsI3kUKdsyFlBbqNT3xQJsINtMaYCxtadVqiTZPBCmiZ2_CDx4mxs9bEi8i_O6_VkEFHdmENbjR_OETPmF7qEiiAZXdR63TmtB3PmS5uYmCZf9y2Wx71lfSJvB-fdA1GNy3PmBo2it039zC5JfONd8mVE1b_S38ku0AQ1G3tFC_q?pcode-active-testids=963892%2C0%2C5%3B968854%2C0%2C2%3B965054%2C0%2C65

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/968287/704c5936420664bb22cb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345165742-9322033560466334988-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 73ms
54ms Preflight 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://csgowfire.ru
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://csgowfire.ru
access-control-max-age: 1728000
content-encoding: gzip
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
timing-allow-origin: *
x-xss-protection: 1; mode=block

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
964 B 157ms
55ms XHR
text/plain 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 WVCejI_zOoVX2Lbp0IqF01CRQ7G8CJD4s8Dez23A89Xy4t8ZdfoK9r3OTXhfdR88E-IblZC-4o3sEMHf_ioZq-Q7loEirliXpFpWVNA1qtxOFpoPUHX7_oJtnIwpF2qFOde0hed2AkCaix7605yb3A3ZL94UFLCilPZW1fGd1LKwWuEbRxusUf3aN5NO8cHK4Gvc0...
yandex.ru/an/tracking/ Frame FE2D 0
278 B 54ms
54ms Image
text/plain 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yandex.ru/an/tracking/WVCejI_zOoVX2Lbp0IqF01CRQ7G8CJD4s8Dez23A89Xy4t8ZdfoK9r3OTXhfdR88E-IblZC-4o3sEMHf_ioZq-Q7loEirliXpFpWVNA1qtxOFpoPUHX7_oJtnIwpF2qFOde0hed2AkCaix7605yb3A3ZL94UFLCilPZW1fGd1LKwWuEbRxusUf3aN5NO8cHK4Gvc0ZY8Iu0jRXWleSGRnBLStkwnJrnRjoizUaJHCFOrv6PQ4vkuPZoX9fn1NCFDgT6_78VUDCHmW1n04HvoMG1R53q-fCKXmQ37499rEIf1_B9oWJk1--FFQy6yCoJImev1YvcshijgBjkKQLGs0t0gWX4Pf_GOh4InakK4WqoPJvF9nb3G9tWdc6dmX4QO2UKc4pD6VsfXlZ5pNLHklc2mWY7nh4cAarTCKy_89__i3zDi-M0cuV_w9z-RGVorpS2VNT6ewxgEfSqPkefrzEwzfBeuUR8_0WHoz-C3jEeGsVmtvcs7MvVtBld9JL7qMrhNzIr-SbCKlTQ3N9GddvM974pYTUOC3bCW6705bIkLIgLr2LkCJISfV-7MLGsbKgaC4_mmwY5xRqbvpExI8hFkcbjxmk59jwY4gOjODrI0BFK7k-zQj8k3Obv8d-loU9uAIew52uVhIbEEcCwKeDhNCVi_~2?action-id=11

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1708110345178682-16197323530486710496-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

91a08d2471a6be4356c7d4
an.yandex.ru/mapuid/arcspireis/ Frame FE2D
Redirect Chain

https://px.arcspire.io/yndx?id=9d4cd41a-f59d-4815-8a89-9d30806f5389
https://an.yandex.ru/mapuid/arcspireis/91a08d2471a6be4356c7d4

43 B
81 B

156ms
61ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/arcspireis/91a08d2471a6be4356c7d4

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/arcspireis/91a08d2471a6be4356c7d4
date: Fri, 16 Feb 2024 19:05:44 GMT
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2

200

0600007F09B2CF651A040B77025F15D0
an.yandex.ru/mapuid/sapeis/ Frame FE2D
Redirect Chain

https://acint.net/rmatch/?dp=151&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F%24%7BUSER_ID%7D
https://acint.net/rmatch/?r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F$%7BUSER_ID%7D&dp=151&tc=1
https://ssp-rtb.sape.ru/rmatch?r=https%3A%2F%2Facint.net%2Frmatch%3Fdp%3D14%26euid%3D$%7BUSER_ID%7D%26r%3Dhttps%253A%252F%252Fan.yandex.ru%252Fmapuid%252Fsapeis%252F$%257BUSER_ID%257D&dp=14
https://acint.net/rmatch?dp=14&euid=3B03420A09B2CF65210031BD02451C1C&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F$%7BUSER_ID%7D
https://an.yandex.ru/mapuid/sapeis/0600007F09B2CF651A040B77025F15D0

43 B
153 B

55ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/sapeis/0600007F09B2CF651A040B77025F15D0

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
server: openresty
p3p: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
location: https://an.yandex.ru/mapuid/sapeis/0600007F09B2CF651A040B77025F15D0
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 154
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2

200

939333c5-6bcf-522f-88ce-bdc9ed010fc0
an.yandex.ru/mapuid/betweendigitalis/ Frame FE2D
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F%24%7BUSER_ID%7D&crf=1&rts=-1323110522019844108
https://an.yandex.ru/mapuid/betweendigitalis/939333c5-6bcf-522f-88ce-bdc9ed010fc0

43 B
81 B

68ms
67ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/betweendigitalis/939333c5-6bcf-522f-88ce-bdc9ed010fc0

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/betweendigitalis/939333c5-6bcf-522f-88ce-bdc9ed010fc0
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/adobedmp/
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=A2967140FECDD973
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=A2967140FECDD973

42 B
715 B

30ms
30ms

Image
image/gif

34.252.225.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=A2967140FECDD973

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

34.252.225.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v055-0a84b287b.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 4cvYozJYSoM=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v055-04d1853f7.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: oZjZRBYUScc=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=A2967140FECDD973
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

match
ads.betweendigital.com/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/betweenx/
https://ads.betweendigital.com/match?bidder_id=161&external_user_id=92E59AE761764D6E
https://ads.betweendigital.com/match?bidder_id=161&external_user_id=92E59AE761764D6E&crf=1&rts=-2001956650453816063

68 B
598 B

15ms
14ms

Image
image/png

188.42.196.115
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=161&external_user_id=92E59AE761764D6E&crf=1&rts=-2001956650453816063
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 188.42.196.115 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

location: /match?bidder_id=161&external_user_id=92E59AE761764D6E&crf=1&rts=-2001956650453816063
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H/1.1

204
No Content

pixel
im.bluevoox.com/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/blueseaxcom/
https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=389EEA882FD5F71A

0
241 B

286ms
91ms

Image
text/plain

52.45.175.185
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=389EEA882FD5F71A
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 52.45.175.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-175-185.compute-1.amazonaws.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Connection: close
Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: openresty

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345182983-14503746470708615480-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=389EEA882FD5F71A
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandex_llc
https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
232 B

25ms
21ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345183295-16990928052647524023-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandexcom
https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
232 B

25ms
22ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345183558-10432675775084418110-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandexru
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
409 B

24ms
20ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345183795-4449906977042813310-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=6B173AD5C19E245&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H/1.1

200
OK

cm.gif
ad.mail.ru/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/mailweb/
https://ad.mail.ru/cm.gif?p=155&id=6B7EB41FB99D58B2

43 B
452 B

198ms
44ms

Image
image/gif

2a00:1148:db00::17
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.mail.ru/cm.gif?p=155&id=6B7EB41FB99D58B2
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 2a00:1148:db00::17 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Last-Modified: Fri, 16 Feb 2024 19:05:45 GMT
Server: nginx
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Content-Type: image/gif
Cache-Control: max-age=21600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43
Expires: Sat, 17 Feb 2024 01:05:45 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345184044-9713261708070256912-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://ad.mail.ru/cm.gif?p=155&id=6B7EB41FB99D58B2
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/minimobww/
https://yandex.digital-services.solutions/api/sync?demand=YANV2EU&userid=619A3C11C41BD9DE&expires=1&usergroup=1
https://x.bidswitch.net/sync?dsp_id=469&user_id=619A3C11C41BD9DE&expires=1&user_group=1

43 B
235 B

155ms
17ms

Image
image/gif

35.214.149.91
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=469&user_id=619A3C11C41BD9DE&expires=1&user_group=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 35.214.149.91 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 91.149.214.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://x.bidswitch.net/sync?dsp_id=469&user_id=619A3C11C41BD9DE&expires=1&user_group=1
date: Fri, 16 Feb 2024 19:05:45 GMT
x-powered-by: Express
content-length: 109
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2

200

sync
t.adx.opera.com/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/operacom/
https://t.adx.opera.com/sync?vendor=60143&uid=1E1372B8C0AA20FA

35 B
467 B

79ms
15ms

Image
image/gif

82.145.213.8
NO-OPERA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.adx.opera.com/sync?vendor=60143&uid=1E1372B8C0AA20FA
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 82.145.213.8 , United States, ASN39832 (NO-OPERA, NO),
Reverse DNS: n-sysadmin-jumpbox-03.feednews.opera.technology
Software: Tengine /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: Tengine
access-control-allow-methods: POST, GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345214952-4181733594332103484-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://t.adx.opera.com/sync?vendor=60143&uid=1E1372B8C0AA20FA
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 /
yandex.ru/an/mapuid/videonowssp/ Frame FE2D 0
0 89ms
87ms Image
text/html 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://yandex.ru/an/mapuid/videonowssp/
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H/1.1

200
OK

user-sync
sync.adkernel.com/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/xapadsssp/
https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=62B5416EBB9F1BFF

42 B
202 B

58ms
14ms

Image
image/gif

77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=62B5416EBB9F1BFF
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Cache-Control: no-store
Server: nginx
Connection: close
Content-Length: 42
Content-Type: image/gif

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345215558-2556980497229973175-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=62B5416EBB9F1BFF
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

sync
gw-iad-bid.ymmobi.com/dsp/user/ Frame FE2D
Redirect Chain

https://yandex.ru/an/mapuid/yeahmobissp/
https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=A0A6EF38D05E1ED5

0
38 B

513ms
93ms

Image
text/plain

47.253.61.56
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=A0A6EF38D05E1ED5
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 47.253.61.56 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-length: 0

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708110345215817-9264315634202170413-balancer-l7leveler-kubr-yp-sas-218-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=A0A6EF38D05E1ED5
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

bf3122be002e4dab8f13738f6d0f4be2563751c7144a8765a523ad849fb3c2c9
an.yandex.ru/mapuid/mediascope/ Frame FE2D
Redirect Chain

https://cm.tns-counter.ru/yacm
https://an.yandex.ru/mapuid/mediascope/bf3122be002e4dab8f13738f6d0f4be2563751c7144a8765a523ad849fb3c2c9

43 B
81 B

70ms
60ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediascope/bf3122be002e4dab8f13738f6d0f4be2563751c7144a8765a523ad849fb3c2c9

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: ms-counter-4.4.3/1.22.1
content-type: text/html
location: https://an.yandex.ru/mapuid/mediascope/bf3122be002e4dab8f13738f6d0f4be2563751c7144a8765a523ad849fb3c2c9
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2

204

cr
cr.frontend.weborama.fr/ Frame FE2D
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F{WEBO_CID}
https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=4249121290

0
45 B

16ms
16ms

Image
text/plain

34.111.129.221
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=4249121290
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 34.111.129.221 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 221.129.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
via: 1.1 google
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:44 GMT
via: 1.1 google
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=4249121290
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 204 match
dm.hybrid.ai/ Frame FE2D 0
280 B 87ms
14ms Image
text/plain 37.230.131.21
HYBRID-POLAND

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/match?id=182

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.230.131.21 Amsterdam, Netherlands, ASN200197 (HYBRID-POLAND, PL),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: https://yastatic.net
cache-control: no-cache, no-store
access-control-allow-credentials: true
x-mode: 554
x-xss-protection: 1; mode=block
expires: -1

GET
H2 204 yandexdmp-match
dm.hybrid.ai/ Frame FE2D 0
238 B 87ms
14ms Image
text/plain 37.230.131.21
HYBRID-POLAND

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/yandexdmp-match

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.230.131.21 Amsterdam, Netherlands, ASN200197 (HYBRID-POLAND, PL),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: *
cache-control: no-cache, no-store
x-mode: 555
x-xss-protection: 1; mode=block
expires: -1

GET
H2

200

U4BQzwnHDIKyjwx7sMHq
an.yandex.ru/mapuid/dmpamberdata/ Frame FE2D
Redirect Chain

https://dmg.digitaltarget.ru/1/119/i/i?i=1708110344
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&ts=1708110345265&i=1708110344
https://an.yandex.ru/mapuid/dmpamberdata/U4BQzwnHDIKyjwx7sMHq

43 B
81 B

55ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpamberdata/U4BQzwnHDIKyjwx7sMHq

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
Server: nginx
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Location: https://an.yandex.ru/mapuid/dmpamberdata/U4BQzwnHDIKyjwx7sMHq
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H2

200

jblStOEOsBKTygNACUzFCXEHdofrVAak
an.yandex.ru/mapuid/mediasurferis/ Frame FE2D
Redirect Chain

https://dsp.mpartner.digital/dmp/syncsspdmp?sspid=4
https://an.yandex.ru/mapuid/mediasurferis/jblStOEOsBKTygNACUzFCXEHdofrVAak

43 B
81 B

171ms
171ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediasurferis/jblStOEOsBKTygNACUzFCXEHdofrVAak

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/mediasurferis/jblStOEOsBKTygNACUzFCXEHdofrVAak
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/html; charset=utf-8
content-length: 109
p3p: policyref="//dsp.mpartner.digital/w3c/p3p.xml", CP="NON DSP COR CURa ADMa DEVa OUR BUS UNI COM NAV INT STA"

GET
H2 200 server_match
euw-ice.360yield.com/ Frame FE2D 43 B
199 B 102ms
31ms Image
image/gif 52.31.236.51
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://euw-ice.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fazerionis%2F{PUB_USER_ID}
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.31.236.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-236-51.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 16 Feb 2024 19:05:45 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

6efed9a9-5916-48f4-5725-d723526b46fe
an.yandex.ru/mapuid/buzzooladspis/ Frame FE2D
Redirect Chain

https://exchange.buzzoola.com/cookiesync/redirect/yandex?redirect_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbuzzooladspis%2F%24%7BUUID%7D
https://an.yandex.ru/mapuid/buzzooladspis/6efed9a9-5916-48f4-5725-d723526b46fe

43 B
109 B

94ms
56ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/buzzooladspis/6efed9a9-5916-48f4-5725-d723526b46fe

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/buzzooladspis/6efed9a9-5916-48f4-5725-d723526b46fe
date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
content-length: 113
serverid: TODO
content-type: text/html; charset=utf-8

GET
H2

200

8732422470802797314
an.yandex.ru/mapuid/targetads/ Frame FE2D
Redirect Chain

https://eye.targetads.io/sync/yandex/
https://an.yandex.ru/mapuid/targetads/8732422470802797314

43 B
81 B

83ms
82ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/targetads/8732422470802797314

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/targetads/8732422470802797314
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0

GET
H2

404

SaZdCHQlSEOBG4v2QWwNWQ
an.yandex.ru/setud/mts_banner/ Frame FE2D
Redirect Chain

https://kimberlite.io/rtb/sync/yandex
https://solta-sync.rutarget.ru/sync
https://kimberlite.io/rtb/sync/segmento?u=NZ-EdDEgk17D
https://sm.rtb.mts.ru/p?ssp=toptraffic&id=Zc-yCXFHsac
https://vma.mts.ru/match/second?ssp=59&exu=Zc-yCXFHsac
https://tech.rtb.mts.ru/?dsp_uid=49a65d08-7425-4843-811b-8bf6416c0d59&return_url=https%3A%2F%2Fan.yandex.ru%2Fsetud%2Fmts_banner%2FSaZdCHQlSEOBG4v2QWwNWQ%3Flocation%3Dhttps%253A%252F%252Fvma.mts.ru...
https://an.yandex.ru/setud/mts_banner/SaZdCHQlSEOBG4v2QWwNWQ?location=https%3A%2F%2Fvma.mts.ru%2Fem%3Fnext%3D59%26em%3D0&sign=1960638163

43 B
105 B

62ms
62ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/setud/mts_banner/SaZdCHQlSEOBG4v2QWwNWQ?location=https%3A%2F%2Fvma.mts.ru%2Fem%3Fnext%3D59%26em%3D0&sign=1960638163

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=windows-1251
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: nginx/1.20.2
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://an.yandex.ru/setud/mts_banner/SaZdCHQlSEOBG4v2QWwNWQ?location=https%3A%2F%2Fvma.mts.ru%2Fem%3Fnext%3D59%26em%3D0&sign=1960638163
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2

200

/
an.yandex.ru/mapuid/targetrtbis/ Frame FE2D
Redirect Chain

https://match.new-programmatic.com/userbind?src=yandex&pbf=1&gi=1
https://an.yandex.ru/mapuid/targetrtbis/

43 B
81 B

107ms
107ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/targetrtbis/

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: nginx/1.22.1
Vary: Origin
Access-Control-Allow-Origin: *
Location: https://an.yandex.ru/mapuid/targetrtbis/
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET pixel
mitdmp.whiteboxdigital.ru/ Frame FE2D 0
0

GET
H/1.1

204
No Content

cm
nr.bidderstack.com/yandex/ Frame FE2D
Redirect Chain

https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}
https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}&pupa=1

0
194 B

7ms
7ms

Image
text/plain

167.235.176.63
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}&pupa=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 167.235.176.63 Bühl, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.63.176.235.167.clients.your-server.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 16 Feb 2024 19:05:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 0

Redirect headers

Location: /yandex/cm?user_id={partner_user_id}&pupa=1
Access-Control-Allow-Origin: *
Date: Fri, 16 Feb 2024 19:05:45 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

000022d4-65cf-b208-a871-8fe072057701
an.yandex.ru/mapuid/ramblerssp/ Frame FE2D
Redirect Chain

https://profile.ssp.rambler.ru/sync3.302?pid=188
https://an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-b208-a871-8fe072057701

43 B
81 B

59ms
59ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-b208-a871-8fe072057701

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=0
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
location: //an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-b208-a871-8fe072057701
content-type: application/x-javascript
x-passed: 1bal2
content-length: 0

GET
H2

200

xtcRiQCedKS.AikABlGNs091aw
an.yandex.ru/mapuid/getintentis/ Frame FE2D
Redirect Chain

https://px.adhigh.net/p/cm/yandexssp
https://px.adhigh.net/p/cm/yandexssp?bounced=1
https://an.yandex.ru/mapuid/getintentis/xtcRiQCedKS.AikABlGNs091aw

43 B
81 B

56ms
56ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/getintentis/xtcRiQCedKS.AikABlGNs091aw

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
x-backend-id: f21-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: *
location: https://an.yandex.ru/mapuid/getintentis/xtcRiQCedKS.AikABlGNs091aw
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 y
rtb-eu-warsaw.intent.ai/um/ Frame FE2D 68 B
925 B 80ms
49ms Image
image/png 2606:4700:20::681a:e45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb-eu-warsaw.intent.ai/um/y

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:e45 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-envoy-decorator-operation: bidding-gateway.infra-prod.svc.cluster.local:8080/*
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 0
content-length: 68
pragma: no-cache
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HsM%2FGqfaa45jnpVeNoNqUTGLT0LW%2BMIiKOXsd2xD5hv5TkwweviXBNSXtEa1o8%2Bqel%2Bue1nJ%2BiXfsgMEOPgvAROPqZ0nbRkGjI03B%2FLr%2BIM6q8EIE%2BbhnO%2BPzrPEXQ%2FlWWrmA%2FfOwPM7ykfucwaesMnTL65R"}],"group":"cf-nel","max_age":604800}
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
cf-ray: 8568105b4c872bfa-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 11 Nov 1998 11:11:11 GMT

GET
H2

200

OiPo8xPsmMTZTnXkL1cy
an.yandex.ru/mapuid/kadamis/ Frame FE2D
Redirect Chain

https://s.uuidksinc.net/match/501
https://an.yandex.ru/mapuid/kadamis/OiPo8xPsmMTZTnXkL1cy

43 B
81 B

59ms
59ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/kadamis/OiPo8xPsmMTZTnXkL1cy

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/kadamis/OiPo8xPsmMTZTnXkL1cy
date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx/1.23.2
content-length: 0

GET
H2

200

pixel
shopnetic.com/api/rtb/dmp/ Frame FE2D
Redirect Chain

https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex
https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1

43 B
406 B

78ms
78ms

Image
image/gif

77.244.216.90
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

77.244.216.90 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: nginx
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS"
content-type: image/gif
cache-control: no-cache, private, max-age=0
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 03:00:00 MSK

Redirect headers

location: https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1
date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H2

200

49a65d08-7425-4843-811b-8bf6416c0d59
an.yandex.ru/mapuid/mtsdspis/ Frame FE2D
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=yandex&id=map
https://vma.mts.ru/match/second?ssp=55
https://tech.rtb.mts.ru/?dsp_uid=49a65d08-7425-4843-811b-8bf6416c0d59&return_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fmtsdspis%2F49a65d08-7425-4843-811b-8bf6416c0d59
https://an.yandex.ru/mapuid/mtsdspis/49a65d08-7425-4843-811b-8bf6416c0d59

43 B
81 B

56ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mtsdspis/49a65d08-7425-4843-811b-8bf6416c0d59

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: nginx/1.20.2
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://an.yandex.ru/mapuid/mtsdspis/49a65d08-7425-4843-811b-8bf6416c0d59
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2

200

ct_sync.php
sync.magnitent.com/fbfli/ Frame FE2D
Redirect Chain

https://sonar.semantiqo.com/dmp/scr.php
https://counter.yadro.ru/id127/reff-id.gif?sid=320351a0ba5b4e56818934770afac412
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=BB054C0A82C602F2&sid=320351a0ba5b4e56818934770afac412
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=320351a0ba5b4e56818934770afac412&spid=BB054C0A82C602F2&v=
https://sync.magnitent.com/fbfli/ct_sync.php?ct=de7c5cfa6dfb4722abc241f9dfedb17c&sonar=320351a0ba5b4e56818934770afac412&spid=BB054C0A82C602F2&v=

0
675 B

140ms
34ms

Image
text/html

95.217.109.66
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.magnitent.com/fbfli/ct_sync.php?ct=de7c5cfa6dfb4722abc241f9dfedb17c&sonar=320351a0ba5b4e56818934770afac412&spid=BB054C0A82C602F2&v=
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 95.217.109.66 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.66.109.217.95.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *, *
date: Fri, 16 Feb 2024 19:05:46 GMT
mode: no-cors, no-cors
cache-control: no-cache, no-cache
content-encoding: gzip
server: nginx/1.20.1
content-type: text/html; charset=UTF-8

Redirect headers

location: https://sync.magnitent.com/fbfli/ct_sync.php?ct=de7c5cfa6dfb4722abc241f9dfedb17c&sonar=320351a0ba5b4e56818934770afac412&spid=BB054C0A82C602F2&v=
access-control-allow-origin: *
date: Fri, 16 Feb 2024 19:05:46 GMT
mode: no-cors
server: nginx/1.20.1
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame FE2D 42 B
201 B 313ms
58ms Image
image/gif 81.222.128.215
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=109
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.215 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad15.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame FE2D 42 B
201 B 290ms
67ms Image
image/gif 81.222.128.215
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=19
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.215 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad15.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK /
sync.bumlam.com/ Frame FE2D 43 B
390 B 50ms
8ms Image
image/gif 31.172.81.160
DE-FIRSTCOLO www....

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bumlam.com/?src=yandex
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 31.172.81.160 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif
Date: Fri, 16 Feb 2024 19:05:45 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Server: nginx
Connection: keep-alive
Content-Length: 43
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2

200

6372046a-ccfe-11ee-86e0-002590c0647c
an.yandex.ru/mapuid/adsniperis/ Frame FE2D
Redirect Chain

https://sync.bumlam.com/?src=yandex2
https://sync.bumlam.com/?src=yandex2&s_data=CAIQARiJ5L6uBqIBEGNyBGrM_hHuhuAAJZDAZHw*
https://an.yandex.ru/mapuid/adsniperis/6372046a-ccfe-11ee-86e0-002590c0647c

43 B
81 B

56ms
56ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/adsniperis/6372046a-ccfe-11ee-86e0-002590c0647c

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://an.yandex.ru/mapuid/adsniperis/6372046a-ccfe-11ee-86e0-002590c0647c
Access-Control-Allow-Origin: https://yastatic.net
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2 204 yandexortb
sync.dmp.otm-r.com/match/ Frame FE2D 0
69 B 551ms
501ms Image
text/plain 138.201.65.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.dmp.otm-r.com/match/yandexortb
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.201.65.68 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.65.201.138.clients.your-server.de
Software: nginx/1.17.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 16 Feb 2024 19:05:46 GMT
server: nginx/1.17.4

GET
H2

200

NTdmYWZiZWJkMjk3MTI0Mw
an.yandex.ru/mapuid/gonetisnew/ Frame FE2D
Redirect Chain

https://sync.gonet-ads.com/match/yandex?id=[buyerUid]
https://sync.gonet-ads.com/match/yandex?id=%5BbuyerUid%5D&chk=1
https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw

43 B
81 B

58ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw
content-length: 0
x-xss-protection: 1; mode=block

GET
H2

200

7b2d927f-afbf-48d1-9221-6183dba6e2c0
an.yandex.ru/mapuid/upravelis/ Frame FE2D
Redirect Chain

https://sync.upravel.com/yandex/sync
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://an.yandex.ru/mapuid/upravelis/7b2d927f-afbf-48d1-9221-6183dba6e2c0

43 B
81 B

55ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/upravelis/7b2d927f-afbf-48d1-9221-6183dba6e2c0

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:45 GMT

Redirect headers

date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://an.yandex.ru/mapuid/upravelis/7b2d927f-afbf-48d1-9221-6183dba6e2c0
access-control-allow-origin: *
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: false
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0

GET
H2

200

mG4qoGRBQYrss8i098BdpA
an.yandex.ru/mapuid/dmpaidatame/ Frame FE2D
Redirect Chain

https://x01.aidata.io/0.gif?pid=YANDEX
https://x01.aidata.io/0.gif?pid=YANDEX&bounce=1
https://an.yandex.ru/mapuid/dmpaidatame/mG4qoGRBQYrss8i098BdpA?sign=903557970

43 B
81 B

57ms
56ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpaidatame/mG4qoGRBQYrss8i098BdpA?sign=903557970

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
access-control-allow-methods: GET, POST
p3p: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA'
location: https://an.yandex.ru/mapuid/dmpaidatame/mG4qoGRBQYrss8i098BdpA?sign=903557970
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2

200

NZ-EdDEgk17D
an.yandex.ru/mapuid/dmpsegmento/ Frame FE2D
Redirect Chain

https://yandex-dmp-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/dmpsegmento/NZ-EdDEgk17D?sign=1547326390

43 B
81 B

58ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpsegmento/NZ-EdDEgk17D?sign=1547326390

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/dmpsegmento/NZ-EdDEgk17D?sign=1547326390
Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: nginx
Connection: close
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

NZ-EdDEgk17D
an.yandex.ru/mapuid/rutargetis/ Frame FE2D
Redirect Chain

https://yandex-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/rutargetis/NZ-EdDEgk17D

43 B
81 B

56ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/rutargetis/NZ-EdDEgk17D

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 19:05:46 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 19:05:46 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/rutargetis/NZ-EdDEgk17D
Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: nginx
Connection: close
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET d.png
ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/ Frame FE2D 0
0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7C2D 42 B
63 B 40ms
40ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNdQaKJMfm97U5sk3wOnX--9pHIwoEVfrUjf3_AsxYXNnhUg8Gc2BOobPOa77gkisU5qQY3C_RppIA0kiiaAtoUVHltUvIGavGtvlKpJ1jLTSZNko

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7C2D 93 KB
33 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 7C2D 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 7C2D 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7C2D 204 KB
61 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 53FB 0
20 B 43ms
43ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNWgHwhOQpBmTKxTO500z0TItxf1A7T-bAuRzfSMNXuT26Xxh8sWP3WPipzVSZe-fthGNFzQZnV7N2j3OB4iuECKDWNlB5u_lhb6HO0vo6_nNhV51mQXDmbvTqTQF4wIz0qJMS34NXbnbnj_nfi8vBHcyD4vG-zQKtJjrn6ZONLJhHjmW0w

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D64B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOWU14L0iDNvkFNTE6woPZA&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOWU14L0iDNvkFNTE6woPZA&google_cver=1&C=1

43 B
742 B

31ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOWU14L0iDNvkFNTE6woPZA&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNWYmBawVOXWZfjOgtuOZN7IpM5mf2fHCVbJDzsUS4rePsFobE8_wke7lc5JpVqXc3JYZ1UyEkvsNqNLRw3kxxzYzGjBNY8GjJS5IyZz-6xjNYFK3UKl01fgBH6GX-71NDrcAe8fUknfZstkSF8n3ilFn_Sx5qsiCaPYlkBjGP71P1O17lY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PpXQw8D2nFOUg%2BsN0UnZ7GRCV6b%2BQBn4U1BjWvO39GWPHfdfEDqwNTcPlN9JEY%2FLrPOOdOM9%2FiI%2FjBFzBQSFB12g8vXZRxZnVFk45E%2FKsCazCL8UbxW%2FFCjsbotLGmMi4lNaSkFq1ZR8Jw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a0b039191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CQdyaHWlqg%2BeCQ%2BLe1B5%2FJEwq7KIRbeKColZUgaq1vM83Gi32aRslxqXhtBUkdOOjwrILCVrmFMbnnQpVJMzGb4GgpMah2ghG7i4XLjTZ4v2TdjT9nX%2BQVq1Y6d4PkUF%2FEAH9uWgXevs3A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEOWU14L0iDNvkFNTE6woPZA&google_cver=1&C=1
cache-control: no-cache
cf-ray: 85681059cfff4da6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D64B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.yCVVbLWsAABt9ANSwbwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2

43 B
735 B

44ms
44ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNWYmBawVOXWZfjOgtuOZN7IpM5mf2fHCVbJDzsUS4rePsFobE8_wke7lc5JpVqXc3JYZ1UyEkvsNqNLRw3kxxzYzGjBNY8GjJS5IyZz-6xjNYFK3UKl01fgBH6GX-71NDrcAe8fUknfZstkSF8n3ilFn_Sx5qsiCaPYlkBjGP71P1O17lY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PuOqqo%2BdI2JaNo0XDeERU8nhqnMM%2FKeeGzs4R2EeXVxOJEwrD6UUCNi2n0XU9kVRcScmNi4%2BsLt07%2FLjxOPgAbeQVbCXkPHomTCXgcJRvmCybwUDaeVgo9Asu5DQtuQpUJTiZoioW%2BInCA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a7bc79191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame D64B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHLOrghWsLT6rLigDQFI_Bg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEHLOrghWsLT6rLigDQFI_Bg%26google_cver%3D1

43 B
1 KB

36ms
36ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEHLOrghWsLT6rLigDQFI_Bg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNWYmBawVOXWZfjOgtuOZN7IpM5mf2fHCVbJDzsUS4rePsFobE8_wke7lc5JpVqXc3JYZ1UyEkvsNqNLRw3kxxzYzGjBNY8GjJS5IyZz-6xjNYFK3UKl01fgBH6GX-71NDrcAe8fUknfZstkSF8n3ilFn_Sx5qsiCaPYlkBjGP71P1O17lY

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: ff1c949e-d68f-4322-ba7d-5b49a3aaac7b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: b1012069-f2ce-4f12-9d42-73a9d6fca43e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEHLOrghWsLT6rLigDQFI_Bg%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D64B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

170 B
188 B

20ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: b39ba34b-3bbc-4aeb-a2d4-a5e36fda7533
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402070101/ 166 KB
56 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402070101/reactive_library_fy2021.js?bust=31081078

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9c7c9a4ff1709a4b014a062a20249c7dedd76889ca65accb95d7a77047b5316

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57346
x-xss-protection: 0
server: cafe
etag: 13531101144786162715
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FA0 42 B
63 B 43ms
42ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CfoQkR4u_tYfIbrOtVD60mc4J4QBr9nGnb24tqoIbYpyjeXwX0HmZpoRub0OZbFDVHBEAOB7TijrcabUawxVQxb4_IvrmHOLxxBiw9jHvFWikL9kY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3FA0 93 KB
33 KB 75ms
75ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 3FA0 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 3FA0 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3FA0 204 KB
61 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6860 624 B
245 B 46ms
45ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVDdfDX4dRrUPxlGkPl-o67kYU5MHEs7ZB_t3tr1HNBUycdoAj2G0Vxvghz2wvzqXwCxs-U6k8d9dP0UT4alp3Az1M_8CaZ9ODeywtSU5Qq4chLgcaLvAqoiJPMMkR6x7Yk9Qf7g0Iz4KvZRNeZGpKwikH6QxLkgcyacFkbWa7pX89byIs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BF4 42 B
63 B 38ms
37ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AJjhGphOmPe9r-WSSpCqiuLjvRFjQ2WhtMvPVfRL92MO7K2JhGUGHOQlrDRZGRhRwsrCYjyooSIDA1ijECSv2rIT8E9WY0QH_rB7kJYLAsfgPYizo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344615&bpp=1&bdt=681&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6BF4 93 KB
33 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 6BF4 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 6BF4 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6BF4 204 KB
61 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 808D 624 B
245 B 45ms
43ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNXwIkqSyiHXHpC8T77V88Z42qob1u4j0IqdHiLZMcoEDEcuz8rATyby9QvWFC0lsmc40iRAedBWHVQP6DFTm4OjJSnsyaS99JSrlD9Y3YjBFJ-OyavMUoMuV297P1Fpmn4YqzjWSSXysEvcJCIawhU95PCCIKdXwUVz6GQoJGxG0r_aJoE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344615&bpp=1&bdt=681&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7C2D 0
20 B 44ms
44ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7795843984118&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7C2D 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7795843984118&version=m202401290101&ct=77&x=1&cor=15161106222873354000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7C2D 35 KB
20 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AkUhg56aTKJcXnywkA-D0BG1cHH4Ac1PG2cwBWTTOTG8ZlHfGvz_pORVI1YJovjTSS2anK1TImqpdDmPn1FXmT7DysSMODc0gXNuy3KYZTM6ZQsy2jsl5MC9PauiS4CDE7B3vBMSqg_8xLnRAYv4yEyXrNQMVFGpa_8HqgcNfUyytYnrE&cry=1&dbm_d=AKAmf-A5CqaRfF6kRvg3aIaJm0e4m0dQQFQGdt2zXLmeSo7jonSIA2eAO2SErfrY6k7ZnWfNvQlcyE24pu6QaFZkOXIzUBFbxPxGEd5Gy8WkyIAVWpFj-fb7vzEs-TJccy2wBdbHf9Ec7hssvSnPmlJEuUvrbIG-p5WIXt_S-UZ_hGoJFhYCyZKICWye_FppDqU2cktMg9KJVzOr9y9ZbUmAFAyLhDpZC3OkpulmS_2kMQfhztqrlTKaaPyGOS-Y6uZwZglvFzM_NmSeFFN5s1JIm2qSmpqA4z_BElD0clC0X1jmnoid4mY7jSQJHEfC2LQaLUJfk1kCPTWK--OqMlSgeSZWgMmfsGrboMnIgAspsAqb3G1uMJSeEagSwyMAPNucuTcJrKlcrL3uZiZPL4ZWeT5iAyeYAWRIvM2ITFkicB0YlWsQX3OVIEBC1xH_V_MYN8JDP8nXV4u4dYdbNOJnHN9-pWuyARHNRO-0oesguPZthb45J3nPOP9uvpvX8tO4hiysn86K66iBqIg02KGMjl1F-pJFvPOg53sHK5Ypu-SA7rF9BDXtYlohyffivQYCuhuxlsPrtGUx87uyqsumuKLyEP9JNWCPTNX6jmTT-14kafQwVNa78WB4a0af3Heos-cBwMm2Kvvhrj42tok7owb5jRcpTf2UYyrECn3RN3G0mfn9xlkvzwkU0aL2nq9uzqrQJfUnhkzL9cLyVZA6Ph3gy_AC1WymrxTmBNObEfkuc0rd_1J9npKTg6IR0E1rmtJlFCo2iKXhIXS66EpSJU5RcSNOqV4D9ptgNx8PFxEwPMZd66gI01dSCgZHRJprQhgDY0XGO1QFHi2UBlEcRFV7sBGhf2wXNDC6NInKyGzhMUEwl766UvM49GW5c_t8f5aZgJObR1SgHnTJBF8ZJOGMseNPpfFGRg7TQ5e3W-O9wuGAgTwmJtUFjnFwhbt4DWLGwMtjmv0bSf0ClAMrkbIj0FJLr9W9oUFycohzlXix121SuvVmkfamnx_4taJNnaIkS3CpU_HcTnEa782RhFd0qg7RpSp861HZ8si4_eqgyfYts5FhlNfAokRvUu0a2z4T-HB68M4J7GIVpmmSwMWf2OJhlAIO2wF_YB89nYg2j6ESL2ysQJqmS0hpQQgPmsqYI5RXFvRQHAaeu0zh8YxgOrhyxQeNpYaD6tXnHP95B-TNsfkJtn9ETgPEHmVhxb-JyoqfxhsjxbcJHiLx-FPQpaecTKRRsmHcVvimuv60sjPae7tOCZZoRPkyN9liUKGbJdPOHGI2S2VNm4qIGtmMBjIGqRkHarX4HOZuvzhhu_wT24TbAIR3rw1C3s9EbFac1IE-A421xbyk0UOq9h14FI6tJJq5r1O5PFkG-2I_SMTSuvk09xWY7cieMFKPsDmPDAbNY_FSQhytWC5gQJMvgCP3w8XnxqqTHnQ_ucy3WmqAdqiYFu3P65GG6fTNjGPOuLXzqgM-HfUAYcGVqGprZ_oA8jF_XfirWJVhnBeWxLLMkCNRNFf8Jd-wpZfLqRwqeuYq_b2oVTfxTKa5iR1M2f-fTWRbg_XB-WIPq_ayG2HADmwYEii5kSup0aOA-hUVhgv-w8rjWdHXqV-42S6-CNwFtJCFUyPyUER0gN4QdAuH7LGcvylyN94ANCdmOsN4hJ7nKiFnba_iTgqqbhUERdKVvxcQ5FYpIMfGjFM0336bzFhBs0UFBSZtp7bBJn0iVIwkJo1RougP7EggYcQA1l6lZ8q9Y-XO1qFDpyBOhzDCAzFWQ5svG2h_6kzv0S310OBtfgMoGmFjf3PjrJ2-oC_uoBui2Bga4d8oXWTE8bYPr2E499OQEqMoVCdjlvWk1eeqqUJYM7S7gkWhgY6XSW4q9HZ44Bq_m3vDzEFIde69-R6aF8EvfI8jtARr-yiozx04d_YqS8Oe8u0TfH8yUhMu242qyVpKilWc0p781-EpzFZUF4m6oefY-1jVYWuBp5zxrSHi4OrCYs5bb8qerP3SBW9Rit7Cy115os8gigFc5gV6vyNdPF6dtSSi_TRN7UBxC9aytnqXUeM67CkvuMU4FvNrfqEqUPIxoPyLQi3FHXqMPW8PAZQ2LLRIA00mq9ubB8SFA4H6RTjDtiezy6HHr1lEVxmqz4ip9OA3jP1O9XBxwGarmLgwzG3n5wRpEAmBQXpC2D5iFZB5s1E_87Tc7GINbOB_O-J1NDIbTpCOGfjuqlpagbBXL5j0lag_xlXHY77fFP8u36i9FMTSV9HqjUUHY4gF4OmhbiwL360YoMkdBuHhHJbCrdMaqkamHbUL1AKHWd_qvdEZs5wPiLH3RnQY_aB-c0DVCR0t2Z5pnF_sX-mdS_YnIV79PCTOsd-7gv8aaVfrbNVlODhVvVSK3wicG-QJKxGRh5I8Pdu_eCISlVdVbEqK81MSflBBZqgZx3crzTnl7ZajxzB-O6AOr_92iD07kJViNSj5x-riqxc0pWmbCSci8LXXmneX_E9z1qpvkzrki3gA6vRXVB66Lvor18VkL4s2Cj8kBF5I1z1hJOsDk5Sz0HJDlb_kKG-UbmSInRHQLLsleUrBGWbuVhoTz8-Xxa7gGc8vUzgjHkOaRSIW3mqjpfS7q-VJ4F96HLTYnfYnydf8AxrNUjPciwfSatHarYvxWbuDO6WO0qjDt6oPJqXI0TNFUwQoLFtSUs1LIOunXv_jubNUkQZHRhnN5LXcvCWjGB3pVFtyjvR9tqI1wrB5lZvntBIe6Up5K7GGDNbMBdQEgO5xThNjb9rlmMLGoDpZTYRvLyAhYysa2ZCEyoQHMkv0WhEzorunNgDmoztfn8dg4_AzXk_JVKoLG5fKzatEkMIT5pFQi1KmXtTFkGUSzYNU4Q7O5k_5Az0FsEWfwy25Zvwf7s8crWAuyp1rIh5RUKMivTK-Ozf7jRsdaKEQ50Dw33nOP3iM6AL5Px9HwmgrJAe1pbEGzouv73Ebs4pYUo8tlzfhjYSQR7JK2khNlxYFsECdd2oocVyzdZjwh4b3XajYG9QkfiIM9kEmW7LYXv-RgZyzXnskskXFCV-l3-u34m5VkSxu9hUsksLzWJJ7W7CQT3mmUAuqf17hEtmmNW5Kx4NmhTxN0jAD6sOYFuOFRjiLw1wX2T7PGIZylwlXWcRSHBGkX0-v69bYcEhliJBHjw1w0eSXLN4Yhqv-cYdVS04oE9lhYADLO6DtMBWN8fF58M7oB6zQJwDGQLAOTby68IqOQFdC2WeZFChhJ44jTW0-j2Yp7kBZXiEZE-De57S_YNw-nKz_7tubGxHQrz-T-7bXHngDDitVlf25D8al9jSNas4o88yS_Cio5inedwPgKCgaL2dgmmpwLolB4PeAcDijzrV2zcDyUj41M8QqYRjgdpVlY3orUaoq-QcNzlVTooIOUMRNOlvQdlFmvAst37kYT7VMI1CkjM97NBPsgDKKPbC0XqkRyg9ljJ8nFvkW6OkzXalsM2Y6Ds56sDk7o_-uuXaWFiKxbqihOn61OU5DQTkSNzokC-RFaRnFcwlMI_MZMc5o2-U47YcjK05_I_o3EEaAGFsyWh4U835IqEeY4usOL-2nbJt3AIj4XcLAM08L9sLrgBYjPNQpkQ7hVO1JfrlbPC7FjPXxshkguAItm7CNLt17fh9d3jyg1VtPb2fpXlB3HGBhu0JrMCC2YNmQ8TzCUbNBD49ARMibd5AEstdXHTTa-gg2dMlciB-7WhQH33krfsFOcFU5Cq-aXl5o58PflODhmRa-gUl3rvssdc-hrk5m7fhit-mRSoZrDN5LXAHfqOgaKOsa09jAPXRbzr1QqVPMcBtp79nk1BG9UbZIKYGk28cJqRqWjDP6vBpOCz2jXkWBOgiVGBoMy_xh9SJyLG6rgHc9O0Pf56dK4ohmxPnrkwTuaSMm5ycjonjT0Rqt2vGMH_A0uwFNvRURYceBYZ9rEnvN6sFVz8t6K4h37uu3aO7defkvPLfvbvnprm6OE2n_hfSMhr2Ze3utE7F9gBzF1E883zVhOsO4kzW9iVfd7hCkoHXmF-zzIGgirJAbLUNJYmrYir_gaujDbU8oT15o0SBxKIKU37vrvK3T36xPb8zfOqqO9wfJvOGwKIO4JhIpirixRkDr3kVXrTB3WWMcmqqAvBKo4gfgLX2XuxmKeqN2QFpH9hHgNnnTMavVEyxvTuJd32ZnJfLvQZ4&cid=CAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=15161106222873354000&adk=2228999114&idt=55&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8798b7d7f882d1c0bc7d931d26b29d4546ae1b8ebc9f5c012491f742460cccc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20302
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5CF 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9466567227846&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5CF 0
20 B 42ms
40ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9466567227846&version=m202401290101&ct=76&x=1&cor=17916798543473172000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A5CF 94 KB
41 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATspwKcGU3o60sTvomq8f55xKaoQjaCJ5C1v-GK1ApOvqmCQc-DJ7hXcXDExmqE4PuK0a9peSOOSqwoW7GBJJG6hQxg7EtZbdXAaeZ-xGZVKi6p0haNabdkHq2_jsRjBZQ4hGAcstQI8KfLlACuVKjqv_0YqvrKPQeA-mlB6KlPirfhZZuJUuOlccTewuabftnjqnMzxxhBsmzqLV2hdBy4Lvr4cK5biO_AwTwGm6BTMqCsP8&dbm_d=AKAmf-AlcZWgEMaSutTn0LAj4ArmLHnFqNH4aDyGuwhrSXrE32iBAzWg7-pCVB-XR1ZRJo7OfM9gUZumR4qw4DrfW97thJfQzNV5tzWfX9JPmcpLZ0s1LIq1DYl-f0EiBMta2_AFeO4Vpm9DPRGonu8rVlL4rxHZa5eVYMMBYgpdpQER2blCXPxXl57isd5ahsjJVIBReZKxHB9nKnzlWnue6P8poMLqYtYRc5BDeUk_bqmRd97KZoaG9YVvB25ptAgsEdTcufae3649U-6mRZFZt0Xi7FF1H7r8hAtuMDHzL1BTcrXWYapnxTFXILr1OqVunAwQmCLFB-ML_q36Dx7MM6TqS6BxDuCofqWwdsmBUr-RA07b5V_y8-dV-4NhkZ_zNkTRu7_xHucjANFzUTphXP-O8LSxYVuJdfviKHUkdQMStPeYKqPZndbAzRDgZlauniuy7Hc3b3qGoWYUBPqZ-XQyiSIr8dH-wi1BCyH1WeUFXd1CBRtYarsL6uezdjpXRqMhN7tMUGrEnE6QgHvefRCGyYhaDTjDBn0MOad0uB4p8J5T2n7OFIkHnaER6gNBIorBs5PPRUn2mbgj3AWXOTo3FJ37FkciN5rBRpTyNAjembj5X3ezwCoXnY6F_9ylI0pNU2fbK9V5QJ_MMVV6e9pbocNFlA69uqGKs_uVVJD_qGAKLsMnBJdILn-dedG84jnHMxA7aMTiA2GTGW5X93Lfr4Z3x0MGSPalBBSto23twyI2GQWP_6oY-1PnnULih7uE5IqLdIyXwCwCT_n7udi86nksGF2_XhAd9plzT-odSF3X86sqJJfXfgEfLENLqt3u1h7zkIVg4n4dKTox37xej3stmlwY2iyDl-Ry1h3xcaVtDncm1QeHZGLufWS_elHvAPt0Zb0fhGVGnMEq5D7A88Av_kaUydutQqlHTUponOeGegbcSR0ttOh89hPxTwwgFYy5FQ6CH2zmSaWXyIpr5b2pESIbhUfASTfkTI15dfeYQZonT8192Rz79hblRaIs11QZt0FH-SOkYq6IavqD4Rj745WcLHCUiRSM7Gd_NdiOygcTd0cmnh_5_t4uwbhMhzc5-IXzAj1sNbVPlN1Vekc-GOseYxML2-3h3pEN4-mmWqaBeryro_kpLHmVXvhZaoIlG6eBjUxF8d3jcZGpkSQDZC8ofrpBLy1tAMIpOS4HBKwckccV1xrBuM_3MTK1vLIcVDJj1nLkmH4PqrAfYmdRcbYgm65EMuZztPkYpR1nxA48IVNuCGiVWT8ovg3k1o9zSN_Ppqp-Q313QTBd8CH9cVsrtiuBJEJoU6-AGXbYoW9LZZyk5Q3ev2otPbZJL98zdT9w8dWqGzu7v1ouCLPH0V6xWQTjyf4vZqSqJmrCNht_Jjf93ZkKSM6O5VkCz9E9kDxMvPbTYngunatIb4SEvlnVbztTH_VdU0TiM0rdVBAYiRyMMPaZ_wEOTDxvpUF9VqhtjBK0Lhg-QQl4L9ZUhs4kMJ68Kcq_l4YLtZPyI4qk4Rq1iF_GjiR5ApOEVqNrBllX-IoY-hFysvQRVNR0fUWFbSpwRUakDiN2Dy-dPUJJOxa0ji7ix4rQi0lqhLon8MFK9QGmNM0IQCQ97FJMjPj-qK9Du_Qy0eDd3xP6omP74Fcouv05l8jndkEmv2YtIMaIjW_wO48OaeZ80QHVHIK3s0eQz5zhSOTMenDphAuo7p5vlCIiR0Wj0ja-_GmhKc73TMrP7GbqiPA15OUyQR36q6t6AM5Yf3bDuqAMUu9edsJPD1se2-1r8cke4r9ahhTBivo3x9Kf0yT3Shdls1UWhPxjG5XbZAxwFmalhdiRID6AvbHiH2HYiEWdju5zS9oRw-BwlEoxBxftuGn72phoa3YAGGGwWz1gaM2WAkEnj4YncthRZVZfcvATDfu1jdSNV_R6EhePJ0t8NUCb4idHNGGJB09iVQb0OyJUwfqXIcyLL0EG7cRMvnyn0trsUhHIhJXpucwjHzQisZKqxgK7XPliqxqBBqPHFmAM6r7ZIapGg50gDROolCLROay2QLMHBpiepDZxm7xVrbOxslJRZiPuTKyUvY9pufIpYmnIRwH9DEUHPzZsFj1ubEYBfJwwCcAH5ep6-3K7WIIJAFbMpBdUP_N1vtYKJYEIZkdoOazy1tyhCDoPEwmV7H9KEKuy7myL0LKOjUVcM6T66tKqMtoG6zTOxvxC9EAv78whYLR_kZxfQL_7mwGoMqttCuZfQTqI5vG7wJxTQkYwp5I5NOJwCf6LB6_UESGVocFjJs_2Wo0t1XLAfV218pGiw5xe7PBsgW0BdVcMt_XL7vN3A5WRDPdU3gQneaRrNHFkUhy2LT5SLCADL3JHOf2-_7bIOGrusM-C4AoCcd26g_OXkodBXlZa3tmsnHb2RSuEOvhUYyIshMbPjsHelb3n0RRfTnGWRddrxqyArvsDBHH6LR73RbFRSef_p6S6UfKeNMliOT0Mo_Ox1FCyw8Zxi92-zrpLuu90DGMqtqvI525srv2EbbqmzrXleb-oQ9Up9ba9NmJACCkNuIjrBXuTBnECAcOeKqhnG9SJpRjBMechTAkAMWM5jicSo2VphyhaGr2QR87DkrNou-NAvx6hrCYKxOPMydA8sopEPd57XHVogFmbdFKynD8AA1ZtabTcjY6PSy96rk_zbiOtAq97c_ZfhMufYRoJtGgk37M2F77aciAxX8hoPQN1qCtD_Ebbpy3f0tvHQXPDqpDSRzDbGXKlFEu-kya_d_uymnNpR0q-eyLiJu8Pzgzj_HCNOg5D984gMfOBbABPfG-WbRogvGH5oIVYEz-e0GYiKSGN9FpPBaLli3VCUxjBw0933N_WnyoIMxSt45UKM1PwujWSMpbfui6bpjV_tPYkWjOMl8JkRMLob-TbeeUYqdnfFrlu6DnK1dXLabpYwc41rm-OQQqpmI3StRNi6ngkB2Z0fzVypr8yI4aoegFQSyt--VPFpbWHV2E3_QS4iUpcoYeOjhxOnarhoJAVtc9zLfCop4y2XEcD4A6u5QqjVxhPNtz34OkUVha_Tt8AScBMHlmf72PD_iXK2Nqf1KwFXJGHOtTtNEat6yKn7p_rCPNfpScR70u1jabdHnh6slj8J0bpJZRMwpJ5sxv42zXLl7xeZBnF-U2YReROhMhmWSj5jaaC_14UBDeh11rebzsu-WUCfOhPM9CksEdSPpd5mS0n6SzAld8j247lxfGXISQoshpTEexx-JS36ZKBSTpj-WED-DvPPDgLg8Z8NID_5SKA58NN2498pGNM7xXFD7OrZvw3mmCFLD9DSShMub_X6_naM2ybTZa4qECv2wNP3lEMD0qnxy9PS1UjgwlVrMnfbTQbcvvo4jpjEkibUnG7hKrqF7DEsJJtonB6QoZ84c-CMDfec6a_UxwnIH7Dp0776V7wHdaB4WB08qaPKtHpaDFQy0JgvpKxDKSiyVAUME4wQWpRdBZiRTJffLBlxG9XJy4V7oNbVVXtWKYznfKy4oUjPFlrMbYj6VnNbYEDvrG9trV4H48jSpgqfJcFvleUR1JJPtUFW-8D7UO-RbCcoMaRZ510B8hSICKEH5gzxfx9hnTaUl6xwNBaI01Ebu5SqiBONdaMt1uqsYcjtaWN4gGTs3Rm1AomHkWlV70B1jf9j2ODi_na_NggMCN6-HD3HoqOAb9IK10NqPOniLddAXRb_qFiRnja8CZnzE0EdSG3lU-7_Vkf6mpIqJZt6HO7A_94W9a_hANa9SI-AXMzE4VwwA0l5KwJy7c8ETOKV8SLMB3I_1o8ih3ZXgNggkg1GJyaHI5jq3YDEmrKg53RTLzZQCsKr8zgRA-DhBGJGOhOz1E4cuSeP7uUbcD2SCitrkws-bZMoGND5AN5Mq195AKTOCLc-1zL4JjCyKL6FegcUu6ShXKfOJJnxMl2PlIvXw4g4izDBYOs8mM_2pBOsMSQ2CMBj9pnNSdE0AV3WBCsT-x3zyxM_Wcu7fMV9Db7M0c6fFKyoS2VLqcUHrKBHrw7zbLf_Bbfp2o-a7ev4NGRIQ&cid=CAQSTgAvHhf_k0pjWJr6E1_LmFNleDXbEJAuKtidhpndsofgLTL5WqZp23zIKIwgkWVBwmaojh2NswftJVRIEKZVl-VMqL9S62BFat8YXhZUzxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=17916798543473172000&adk=356101034&idt=95&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d8b02c6d4e710f1885be8a61922ebff762f591ecd5a500a8d115baf85779506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344507&bpp=1&bdt=574&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41477
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63CC 42 B
63 B 38ms
38ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BmBoeqkwim1jICUgBHOeKPNmTb_8uFmTaQlfE9lHy3OEOTfEMmXgDgxNNJJkjK-dDyxqIwn_UkYayJWhelFmXQ52MJZBRhhPQ749HBrZyMbJG_ySI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 63CC 93 KB
33 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 63CC 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 63CC 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 63CC 204 KB
61 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B32F 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BgpzbNQfYbDkR-p7gSN47SqCDGRp1uhPJ-j5nN3Gc0mTZ6G3Ebv6BgICMwk1mW2OS1071Wfb8XgpXaT9ARrCuMZIfZH9E1PRWSameRuZS2lwg1TOY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344709&bpp=1&bdt=775&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame B32F 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame B32F 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B32F 204 KB
61 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 42 B
63 B 38ms
38ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D_-QvAUaxaarGjxhAMY84HxLIUJg0Z-XT1qqZyJ6ylkG1nxit6NJQIsBvZiRyGO6Z46iKWwOHct0RDxtOqkV1K93uKS1jR1XEJek-tWbT2W9HULk8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame AAB1 93 KB
33 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame AAB1 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame AAB1 20 KB
8 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame AAB1 204 KB
61 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6860
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1

43 B
736 B

29ms
26ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVDdfDX4dRrUPxlGkPl-o67kYU5MHEs7ZB_t3tr1HNBUycdoAj2G0Vxvghz2wvzqXwCxs-U6k8d9dP0UT4alp3Az1M_8CaZ9ODeywtSU5Qq4chLgcaLvAqoiJPMMkR6x7Yk9Qf7g0Iz4KvZRNeZGpKwikH6QxLkgcyacFkbWa7pX89byIs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m3S6K6vCqJOM%2BanXvfPvcRtM1mvwmOhy%2FVoRD7aS7obyfjrDVBHG3S%2BpkyiGyWU1GshNBxB8mR82THw6wR9waKLQS7IvLqvQTTz4QI4jkOSQCh95EqHxlZfPt9pkkaggoQy6yWcE%2Bt3HmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a3b5e9191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6860
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.yCVVbLWsAABt9ANSwbwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2

43 B
739 B

45ms
45ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVDdfDX4dRrUPxlGkPl-o67kYU5MHEs7ZB_t3tr1HNBUycdoAj2G0Vxvghz2wvzqXwCxs-U6k8d9dP0UT4alp3Az1M_8CaZ9ODeywtSU5Qq4chLgcaLvAqoiJPMMkR6x7Yk9Qf7g0Iz4KvZRNeZGpKwikH6QxLkgcyacFkbWa7pX89byIs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BD7YlRLXfqHHrdnmboyaEv2wJZsqS6o%2FK%2BhBC3B6zPAbKPPwm64HOry7vE5plWecWTttM4TPv%2Fxp%2BBKkAg1btNDlmOZqWmbu0We%2FphIRbQWtuo0wcEhyIdbThysoEKJ0qt%2BM%2FhoEc0iiBg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a7bc99191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 6860
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

43 B
1 KB

17ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVDdfDX4dRrUPxlGkPl-o67kYU5MHEs7ZB_t3tr1HNBUycdoAj2G0Vxvghz2wvzqXwCxs-U6k8d9dP0UT4alp3Az1M_8CaZ9ODeywtSU5Qq4chLgcaLvAqoiJPMMkR6x7Yk9Qf7g0Iz4KvZRNeZGpKwikH6QxLkgcyacFkbWa7pX89byIs

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: d018a72f-9543-4aec-8fbf-02624b1b0958
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6860
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2

170 B
188 B

19ms
17ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 721badf6-db17-4771-ab3e-a6266b4b0e1f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5A85 624 B
242 B 46ms
46ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUWYxV0zqJoLj2I-gC6pnvkwFmjdSk59RskReUwzoSXMg_HCy37Xnj37ABS9qFslW0ZMDgXq6TViLSpLfvPYrZJvOZMKRpK7iN6Q89DiAswaMdGyevpe2KbNMRuGdUZcLRHFxw156ETqeVdwXOdWKiBcRIHbPmStF3dZ_PXJ3I9Jr6uAeY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0370 624 B
242 B 46ms
46ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGIW-5fgBMAE&v=APEucNVizO5AeMhzgJO9aqAtyg8K6PY68rwpY8TxMtHRqbpPh1rpLx8ro3UY_BSWqhwuyWzrLWQIIWsAioNF-ZS_JukYyA2wwOCaUNYT-L-CW6RjpHR3Q1IIYKmr4xoLwvsFO_yY5zk2QmlgC5xYYIkY0IBeijQLPm0GfTGTZ5dlJDhTDdFcNEs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344709&bpp=1&bdt=775&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame B32F 111 KB
39 KB 45ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 20:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 20:43:16 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame B32F 8 KB
3 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:23:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:23:38 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame B32F 23 KB
9 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:12:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 08:12:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame B32F 41 KB
14 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 808D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1

43 B
741 B

31ms
29ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNXwIkqSyiHXHpC8T77V88Z42qob1u4j0IqdHiLZMcoEDEcuz8rATyby9QvWFC0lsmc40iRAedBWHVQP6DFTm4OjJSnsyaS99JSrlD9Y3YjBFJ-OyavMUoMuV297P1Fpmn4YqzjWSSXysEvcJCIawhU95PCCIKdXwUVz6GQoJGxG0r_aJoE
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5CiNdOBJu%2BW5XAV2ZNrjINxHtpqB25HdnhsvtMXYLiaPOoSRbdVwu3F%2FebML5YGa%2F9GRCgJ%2BlCvm%2BB2G9P5Ju33rIhEpOV4aJPkn6c7HvxXf2%2Fne%2BKsAFKvxfrcT6QAY1UAN%2FPMn%2F7quIA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a3b5f9191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 808D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.yCbmqPWwAAD-5ANSMUAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2

43 B
735 B

38ms
38ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNXwIkqSyiHXHpC8T77V88Z42qob1u4j0IqdHiLZMcoEDEcuz8rATyby9QvWFC0lsmc40iRAedBWHVQP6DFTm4OjJSnsyaS99JSrlD9Y3YjBFJ-OyavMUoMuV297P1Fpmn4YqzjWSSXysEvcJCIawhU95PCCIKdXwUVz6GQoJGxG0r_aJoE
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e7sIfe3MKjZ5gR6PomHRPAVhLTNEsvmpHgamromLxfX6D%2Fl69%2BFFCFvQ8fOpr%2FSP6%2BeyXjOzIGP7cYXosJP0Pa6N8XHlUvCTMY5Gl5NLawrWSnsuWrwju8cOiSIqHmGR32JVzSUV5oxOTg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105a7bcb9191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 808D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

43 B
1 KB

15ms
13ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNXwIkqSyiHXHpC8T77V88Z42qob1u4j0IqdHiLZMcoEDEcuz8rATyby9QvWFC0lsmc40iRAedBWHVQP6DFTm4OjJSnsyaS99JSrlD9Y3YjBFJ-OyavMUoMuV297P1Fpmn4YqzjWSSXysEvcJCIawhU95PCCIKdXwUVz6GQoJGxG0r_aJoE

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 64f8c84b-e518-4f5e-9e8c-c17988a72c3d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 808D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2

170 B
188 B

21ms
19ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 88b6d984-3d30-4757-94d3-273d4ea273f3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzUzODg5NDAwODg4MjgyODA2
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3FD8 640 B
262 B 49ms
48ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNXGTXP5ZjwAy0fhLec2xpKUn1ZpUfRmYGcbIJ964ZJFKrealc-a6IwPhaHc0gJXMXw9ZNc2gTwGlk0If9VqfH6BGxXWfgRDe0MzC-mubPEeGyMPnW2njIanE-0UzdPpK5xbw5Rsp0OImtbwhUdgYsCFczlH0lFlibzg-3HWo12Q2VdqTzc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame 2E1A 9 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57225
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 03:12:00 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 03:12:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame 73E1 9 KB
4 KB 9ms
9ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57225
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 03:12:00 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 03:12:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FA0 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6621673856948&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FA0 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6621673856948&version=m202401290101&ct=77&x=1&cor=13104364476690911000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3FA0 34 KB
20 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVq6rbDD6ytgDA0GIVfVUvG21psqXQHqc18NgQnY_vjt7k3LXgKfaUvoS4lcpKWgW8K1QHlfVOUWePQLD0Xur7OitBC4MmvWaS_tLmoA7rmm0l8YESvEOuE22aQB7Pd-yEBYZM9zW5ERClOA0AGZDqnyp342j5Q8dsDojqKi_dNAUvYak&cry=1&dbm_d=AKAmf-AR4iQerqdXVAlDLulXA0SgJVDEmYzuWmzRJAcTwGjYnbzM9K6izDgkh8FXAJ0IB32tKJ9ftXgFvCjo8ph5YYRXfM6OUNLAQLZ1mzK-MHgGm-SwfGwxNrNBjgYmaTWj37SoOAeodQ-HlAMdVjVt_ELk0_Yb43adlbjyO1PDP19NbpajE7KQvT0xZdY8Uy1mZ3dYd11jdTm76jWTFJtF3e9qURIvszUoZ0doopMXEegDJ0mTDOfUKw6H0Gnfo6Ok0eH-Z2P2WWh90XamcWpMf2e4P1Xljqoba3Hy_SLviALyvToYGcC27PpM8ytfWaShHQ7PnJhhaKP3vItQp1ZKBpTNrQxgQdP_rp7hd0wdH3Ky5EcqZywm8-g6Lchwne2H5OZ1hj0XYiXNITNTVKqqC-numClKS7VWUiM7cXJnbE9zDk2wR6h43mTUWLtoRh3JlwuxrxhT_vN8S2PolQZvrqxDjVk0Mg8CY_NPp93CXO_TNWp1PhhdTTpb-8SWb5guNdsO5ylmwsHMKl-R14nGR8U1VsMmfDqM-PEDGbYQWhWh42426_dIKUWNiWeq2PF9W-9TDoPeWGlFMkTbDxQIfaO_RFiaV1S4TKQatIrO8dFf56YBx2EbQqqlGQm7mWx6cMMtFHTWxCwCSRneI1pUJyuxbS23O6_nsYbL07VjAUA4b7FIgJW5IBIbObSxnoy9mydTXBD4M1d1aWtF4dpO2nTZ3uycbmm-o71Tjn77cw4QBhiMtKJRvb_uT6H8aBPvR-jpTwjjopGXgLpJr44fayAi7UgUJJvnHVm3PiM6HZ4wyjYiNhLm8De_kqLOVk0M5wDDQ8aSlENwH5AUvat3djK4yQR8wX62hGxalKSMWJOtY2TOAtseo539G5UZspKFI0sA5cgAOkPwlchnJpAiSSSrc9WPVSXcJ0BqAt6g_ghqIiQHLFSubgqiZjgn5M-HSPmzHop3wCoD_ftmu-L1m9bOOkRwoqztIK6FutWyw7LHAKqoQ7GUpe6sDF072XXjLFGKcHskovrfME767X9ONE4qIM7nsto4egxgkRkKPxqUDoWhRXtdLo5DQkTmXnA8WadutbDc8u33JGHT2AppPnyys-FKS2DihW4i1BwKo5Qb5vEgV3_ElOzzAL8xzBlsaLyrjsTnNYkiiQi3cwLfBt9-ZTkgdmly_XKEsjelzU6a4OQNEpqXanE-jeNDXmGuD1cYrHwCF_KPm3a6uyrQujcrTd40XiFXmcjDgzL1sHPXfSD1u-4WJ-5LOlDvRFrsbcVIqIYwFpxlqXd9xxVvv4U9WWQbgnk48TdeFEvpAXDlkPn4oM6MhOvlbHQN8nohrj01qNalavWgXiHl8DLdJg22TcHOUU6HxFWN42NpT93qa9TVUPCzaZCRzI95EBPyF0aUoE6XBKS3JD81aNpai2O3gNHd_ZKOzUBCast8LQNPqd-zqSQrf_mxwExIWwx2xumH5gYBRmIC1fIyD-1LK2BG_C6WyUrKlPDVf1lFPZfOMhEcW5fBX8llxwAf_ReUdZMf_obYIhtcuUhARV6WJKRS3OFjoBHkpo32EJICEnkJQmteM8cwmhKdqi_nJ1pI2ctDwbHy20FJ56CP5h3UHbo_AC46S-H6EQfwothWvVp6fUVzaMpXNmJzoiHBSZkSf_8j32yRzpAXqe6ED7bKH_5LRtR277dwKuNUJ4U7wETGKGCg2kJM9FGOO5Fi6xY7FFoPCedKRDAr9ksCYhVoQYUrNSoV-pxoCkdf-7v85wmj_QPIEinQTznp_duOrWYJFKTeOJca4-YI5rHBkg2PC_8jBc6-3uriZOZMt5nBvM9cSb-1bEC6lQgkUjmBceM3YmZ2KMXf2bKuNPstAIxjX1FHBmiOTrOlWGdqlUBc7FUscTnRAK2hxb6IKQRul0jkzu4C2IyC80dsF8HfYaspLpLCyC8XN2MH1uUEqWvN5aWZ90MGPm4TylxVxj_y6k0UGr6UZ_jDyYWogOo17xy_tW46-ZUjGUxOu5Sdq3JP1aySssRHVqXp_GXeZLk0sWRy_iCGOAuz3_EOOsZs-0z4ZiZOCivFs2Y79yFygi2BgJak92SMYO2pI39QaTTGpxP9ICBT5qw37JZcZVRHQ4-2dN8IsBCAEbi4tuRuBBpLRw-J8ksE5c_3yHdLtxOz8djMqsejeQtYOPuTPkCTb_kY9ACxv-oOT2d2SUmNSHG6WEg370Fb3a6rFgOnuP-nH5F7VKhXhADULu69S6cc1-XNhSbmlYGIncxmfmdm4Z8FicRklnWlezmRDby5tL3-0dNjDe3kzCfG3Ni_UKBludU9ApDGLJ5ud4q9rsT0XID13ja5j01V0u4hh8elVV5JEjxp73i-Aq7JM8MG9gCtEy603TJEaC7miozAuToHUbc6ngb7JTw6h-Ik3Yg22xhzm9gEn4N-v6y2UiAmRAVfhYPQd3oJJx95f1I5fnZW6yosuGjuLS46_gTOyOlgVTsrreAiwzJyCyl-xZbtCXDzsYBrJanKX2ROVryqPYkDhyEW8G44zzrXUF0wAJJ5dH58DtMQgGJaZ1M-aK5KAyDtHashWXq8irUde6Mn_3BSYRtKBnqX81wnWjYy8w6IDt_WtKFq2ea7BJS3x0oXR2mcz_-ugHNULz4TdVSyh9HW0dOj9_ufZ1OPgkK-7ApEpLp0VGdCYvm4qW_EuR1NgpEwU-voF6oDf3WzSigyoi6axJc0XFb7wyM_fWDRimEIVdIPQvaa-ZafXHW5JNhSsTeNR5J2KloyPAT0kb49EEIi4-NBfSfn-74nsSKddnPYv3Ix3iAyNGJWbxYeRkARvmfIT3akdAeED5lr-fQ75Z4Vy6hRFKRY-mDPZLyXzb8nTembpb55an0VuWcu1E99adp7GBcSGk-0-r5xQno-R6R75TVu-oxztVgDuBRWH6MErLeH1Mb9SrHV_wUqj4luxEa0hvgvC0jAswB6YWQzMg_VfO6QTrn1WxCTTEB22UwOBefGjO51aPO5t0qzJMEl-RO62QUSosJpGDRYTaIwtvyTJJS9qkoz9BOxzsAX9tYCWWq9hgmEtR855COD7007Oq4LWG7pNKKEtRW3lHQDXcTP0xM5fEuJPoTg2Ck4ZgV2pbMqC2ZKS7b-qVyPf3NZuKSfBFoJkHgf1004UsgEUD6Xt9egvWJEsjbOEZPCghZv7YyDB4Wt4PnTEny6E4Hd4NjCgyO_oY2UsvYb1H91XAnKQqb-2weje_YGVLa8lqCHNdXRcISch4ICIMi7c9qixCA_rBp0WdMDu98CVi6kPPe02S_7FSyH8hCh040ks-Za9qqR-n2t4X4lvmgUCkTAuQA_6QO5VmlwDLusCa2hnAF6zvU7wSw17dzWGtpEhzZYuyRZ4Av7gvoneHzXvCl_XOdNHVeQIz6z1mA8R6WD8sjn5cMKKryCUVfkzRyTziHYUosAAmM9jVQOzuNyzimgB8-0UuvuXDVz0suhQnTuG8audoesE66pTKErjNNVv97JzqCt-BmjtRj-f2lEICCHBcaZwH2Lirn29Cyh7EaPXCZ4b5h4nRFJ-fcRXqmPiFwB8IyUW-j3umLUFaSVyQ8FCFFsWSlce-e9QZ6BhNTn_iQNs43VPPmZeNuxbF3WUei_9KpQELTq2UkgodIcdPSzCA6rT_IUni8WE6gOiiy4FOKxuEJ62KkzD5uT2VY6gDA2kXT0BFLKah0TcbQKP64JHHLCxPvSRrDR5Pgnrk2Yx58mvUAXY-GBU5JeJ7bDkKjL0T_6SVDb59qALnZn3IykfkTxgaeXKBDmlNaadAGHatfYGqUyigWPAQwR2R8_jp1kXQaGQZ7SNf7aow7T3U0B17_O3FC_bsGTrq5Tv2e0cxNnPi3ZeT9B5_2C_WxwJt9VY_zeRs5veGGoaNsU5A3wJmCFMFkKXwH4QNhi6AFtclf3Gh2rsSKPAVm3FVFUOVN-dZ1R8N5MxOLi0EL9l6Zi0xyVuhmqI_DEAfqxJm5UtivUhIZgqjqNGVxVIPLmFWnJAtPpUFqTcnYMF3tgTJ_Ze6g_oJELJOGDHzWTCRSPHfmghDarrTkVHFBeuzoWR6oevNeOV2kPgz19q3ax5Z42mau0IE1kWfGW6rW38m11TS8EyKvh4-OkKzxV0qVJRSQoDML-9UrqEMrqTwT2FyOynl0poby5d5DJ2itrXvxhL7E8siBKgOJ11FVJywXB7QzIkR4M2asYwiNFoWqO&cid=CAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=13104364476690911000&adk=3047537734&idt=101&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

434d0451428dfc6701d568c0e646351b39f0f5b8dbf1c5c44979b39dd5fae6bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19992
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E020 42 B
63 B 37ms
37ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BDHejiOzHwUXNzFtd-hRCh1qdHMADPC0b_6AQPb2pQgqp3RG2WoEPgGiyFt47W7tsRrtJP0ksONdJnCrlZnx7hsSuLEwtLftYpbZ3azz6NvggFtGo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E020 93 KB
33 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame E020 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame E020 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E020 204 KB
61 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
DATA 200
OK truncated
/ Frame B32F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4254a350d1ecdc9a728e43c31a087049fdd5fde70ec2a1ffd6321d9600b2e63d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BF4 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=958272179511&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6BF4 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=958272179511&version=m202401290101&ct=76&x=1&cor=890000848875489800

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6BF4 94 KB
41 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Af7L9KhW6HaYFnYldQU_ogcE9gShCPa6shsjo6XF5K3Pq8YfNbe_nmWSY84dKrV4jvlmJUBb1jXni8iIqGKP2KYYHbCPNo6WPmqX0Q4WFRSIYcVbpoK-xUL4or36TvEdOesQzcemJxpJYnr31Ll1cLjeMetpFt1AMixUR4RQl1Hl7VILuAuXcEUuFkxtSKlObEaQ8D3R1r_D8xWFuPDBXCSUYIGb7YNUY4lugmW2a9b-wkbxQ&dbm_d=AKAmf-A0m0gvty-NAmpo46OFojYX6cVIThmT0YXNVfu5U_UUT440BurmH0iz8fFV4xBhiZYAvDe67FbCokSUNJBc4VeDdCWQlEEKcRKUDwkWTLZUUvpg-1Sqcy9aiFKR4gDHo_W3bx8tQxxHVPtuta2EXskPKUh9eXlLhI8oWIbZ12Ax3eZ4Z7FdNBU9Uzqlv0lVNkyxo3bICxHHNdGFsPmrdFsO6Zbl98GJBBD6-l7jsBcn2yDMxmV10lLGgHj8AvQP8u-Cfqcj2Avj1CwdotcByROPHge8QmDJCHQ3-6hQMIMbybHLUiLaRpBTvqVneu_24x7gNlM0uhUzOx-Pt4iTg6EgEmdl7mVlGg0_vfaQ5NMEeF38cwmazdiliJXa5YQ07ZgpZx-OPiPRMCiNt_HpBB8q7Wz_kD-uN1IEbd16bTVk7RK2i6cKDhEmLMKfJPXAq1fBsgnach2kxxCSmpnq_7fVhSxscBpJMiD_lhOCB2-3bSWMlE71JgsYm3ZxcM2dSSHfSpYHu2phdzaxOkAlxfdshWNgtAFIz1ykaFVnhxq9PI1Wdo8BGX5YGJIrQD5BJOB4V1wXuvDsI_XAo-tK690Gf-HycPiD1Sv-HaVt48OS2nfuB-Gic1dJVfj2ACxmXNtfOb13VR_7Ox174WDNFlJibbmA0d8jLZvBVJd0nl1eexX_wBreXS1BJcNE9-j5RtC-m0iPTboEKhMsqZfolBdrO71V3fpUdvRKCyxFHDXPWckrqmOb7bdOdDdWlKS3I9PAD1f1kYuxjkYk-kQ2tmoAyXfZ5J6Pm2INJo9zSE7QaSXUmaol7eWI7kDo1pUPXfa9oj3mmrdhHAigsluiQEBTtGmRnA6SE3gSssJXX089o3RiUsX_ya7WMDh5yo9p5b7iDqdGOB6ajJgIvNBoNv2bFHIjRYK9hus4s9U4Db3s6F7ci0UO9V2mnSNIDGirhEsZlFjHg-gKTNg9bLBxeBr0j7KOVk-PGNuAjgKMD4_UcNE56Fau0Q82VDumH0prmEyHc7DOFI6bCnwjKwgZJ-aWE_JbGs9ENXOsZ08l8skW3IX9Mic1Bf1S6F6n8XI1d59i4KZ-3TGp92OIXtxbCX0XGv4DA5XeuchxAXxsmifZTMc6Ybcy5b4_ntgL_AWWKx58XUwF3b4IvnsvKPzCM1T4fgUEK41VkfkqeLK5K015XH0qWboNLn6bdRLXpY5baPTjVf_KsqHZipqgscuzYjHA7-Vkl7voYKt-bb87tsqVBpHInyeEG6LDD3BRQAVSUvSKa3qHx2nC6jd5znlJnA2pUkMFJvV8dg1DO9_TCI9-98TSXD5qFQ_awJYcZEZkdiD6KsspJ2gAVaxgVIp8wqWRasE7PNtgTJrgJF-c0sQVFg2PW73EH7HIWauAQDs3nrKjyxQ401U8mtz9d2wSptQvYA0y7me78F7qr8R7U6f8SSk_3CH2YYZWiL8NKA0SsLutLNsjIMF7OpRy6ACACHQ8VE_4ck5HXEqmTS3vjGrEay_1tkw6Fqggk7pMBM2CZRbGN2aJdDm671d33O80qZisAGpVg9CJw8O-W1nYXUfxzxqGyZaXpp4uThWpwRrPH6C2p_xSg9E0PGtGJMC2wuDRLGQvl3x-NSxa8hDkcVB8kNb8LRW28B_Hctw2hYg6l0P1fFe4T-veYJFkayGP6zVGyIZpahS1oMG5e4DisnQ97PbteyR0HLRIYhn83qAaTu8z1jd-xqH1umjOw3zxtw-BGVd0RDq9ichzPcVqlb6jKFgReWX0KVGj1JX6Rg2YB-9sdk5boVGzsx4VvONc4mzgwQaBHpc7FTiV4ynUvSSHCT4Y6SqjzplS1yV0Y5BcnDASvpxU4Hn1CJwkRRhqowcr8X9sRB0EmeHv4eQO6vY_6TH8nBoQ1A1Nh3Ov0WuQJ1fXtzVNmd3N6TKpGhGGmcTqMZkNSQC8oDCbbbSOiatZdMnvY35ozMrLx1-PlWW5-M50hGb8R3xofDVWdCXAo4UTF-iG9fZZx33D_HMXOwyJpOAmzrv2hI4Ig31kAoi3pvjakIcaUnCj1k3JWauCfHousdTCvOt_WTYbuoe9rWSrj6TwCL6ZCG9I6ilqO7oGDtdrqEoZaZ-2bZhek8ZHODyIbjYizopwmoZXZVlRY_3oZVbVubpyLQqA3aexAHgm_LKSVB97GE2jrSt8t_kV5XYMtRueF9u65hp-GN34e5vle_2mJbbBDb_bkkiBOD7KpB5hOfVamSIXIEALtN9oA3E5D6bvH4CffG9jGXnOEqU2o-ixRXkSxIKnN9QZ9RuT9chnbwf3DErrJRxpMnYyHILYTMNWF1L61thj2sX5FDN95Om-G0glcPYngTObzjg6OSVdUxRvAUyWew8KphQzHlDE9LVKTaUSMJfuBWTcuEVVD-FOCtNNsTzNrqYDO8z3Uv6G_V0nE4KFyxa7lu-dZr5LqSzv1yJzKY2Wd-FOSH9OCKQyjye3a7Wm_CzAuAULBFmBNLhudosj0J5Ja_eZwO42SQzvXO0QeJhJYM4GNS0_PsdiclicZ7sdVO0rh5oeNWQjcUrAY3PR4MmBRklnafSkk-lIY5Jjr9y2dspDYDIhlvPUviolkIugTEayTZkLRcOaiWzPP8xA_JVMAta8iHLUtKpskynP98bdkApXj2npzKcf-yf5zMcrmdoJGCLAOEvaRunOg8z493xg0khkIufYVwUTq3e_phrvMjz-9YDxaMc1YcoD8pnzLviq40WiD45SLQByDWaHyl_xI4D5IAAcP4haLJBRjbuQf3EEbsTw1Y92mEm-uHx3F1zwc5Kydx41prC44WGjklMbR9ZBJtrHwEOH4XybpYlXx9Z_MlKVMLKSf2wJQOn3rtiEyB2km1-rZIXnpfESN0bHpmcgU0TYuNrtoWsaMVII8gAkVAR5W90Ls2IZyx-Gg4AZsFJOab6MgGhy80JArilM1pMlvJooT-EPb_S9hw4ct9BbO1EqQ8_4g6fwM88e2pQ_H7OvkEInB7ENp6S8m-3feFZebXcwte6oPHZ6nyN-ChgHVfFqXRaFvmNf_0pyBCpimI3_NKWTpVrt78fLGeb3i6FxU6sS9S7_X5GC2vuaFyLqcJUSxjRgFZ8cv_mmkMmnM_IXC36a4cxv16CBUJ9EmJmelSL2qlKsUoqu2mHfTuRpjB2fLEAjcuq4fv3uc_4aCQxspb_r_phIsAVSVtwiwEPNwQV9JD7C_ABs_AE43pEJ6yRtUgF-YUlRdHkju1hCo14LFZuHLxlQ8RAEE_quaoygEooxtD1b2JnbbpJ35no6AuBH21Sz1oJmdUXn65LYMlcy2mjag_arXFo04aEnNgU9ep-fa3T6ar17li8iddVgE5_V_rAV5eY5eSEYYpq1PomPgzYEpyQ8XlFT-FegDCR_cNPlqxSAX6kP_dhfYs9VfhIE1PioROiIEZjMqi239i-lvJkHacX-mYW8ouczkNJ1O-Wx1mbFUa1uv0z61WVLKcrYxI9DCcgHezmHf0YvEyqHQm6PuD5bJhwplA4a0zu3FSedZxATog0Tzp_Rv9R2yfiweGGrOBPzVrrnADgK954S3XH6mcW4MScHCcJ3EqYVbupjktNObOL4kqzBDmHjYF5b7yrc81pesyfrZu4N_DCdhzRsAbsfkVR1PNFYXpwYahQqTyeJPprYSbvSfBHgAnlPFOE0Dx7G-_JWglsYin2pkVN4s2R0QCNEhxnlpYKfjrjRJC62IOgpAR84iMs_9R8Qwsx9bdu3QJ4n1YFOGe2Yqw0VyMsMeZ5A8Cloox4w4gW8pbAebsJ658KloP5sNfYDgYDSixDxIcvPOQ4gg0nMD-BEHTkCiad7ssIQ7-_uy0VkJpwj_hPm-1osQDy0qeoXKFgiUee-Y1lm2GtsOemevAQH_c9qGtG9kNU-8xVwhfEafJ5TpY5xMAbpzvmiDoVspcRAgMTjtJ3cPsrK0Y0yvkeEF6KbSEOQM_ss7BShOR3RSl4b15t0o3C3hBAWsqE0t_pkPv2jE8CLXAT8Pjq4ITqAtF78qPmAS-fXE91kv_CkT0eNMg7XyZUjXA0eg3KGr3piii8&cid=CAQSTwAvHhf_K1Ers7iRhZOb2J8rbKu4NwdtO9N1smBwrAX5yK3YLeA2Gg-AxD20UpXQIUoMjIJ3T_-klqVMJYppovjLb66TwrJIHwUTMUBWKJ4YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=890000848875489800&adk=250412561&idt=70&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d891d1e6b6ef9c13ecd29aef59f34d5c0cddc9a54feaa3d0070fb7ccf1e136e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344615&bpp=1&bdt=681&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41952
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 7C2D 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AkUhg56aTKJcXnywkA-D0BG1cHH4Ac1PG2cwBWTTOTG8ZlHfGvz_pORVI1YJovjTSS2anK1TImqpdDmPn1FXmT7DysSMODc0gXNuy3KYZTM6ZQsy2jsl5MC9PauiS4CDE7B3vBMSqg_8xLnRAYv4yEyXrNQMVFGpa_8HqgcNfUyytYnrE&cry=1&dbm_d=AKAmf-A5CqaRfF6kRvg3aIaJm0e4m0dQQFQGdt2zXLmeSo7jonSIA2eAO2SErfrY6k7ZnWfNvQlcyE24pu6QaFZkOXIzUBFbxPxGEd5Gy8WkyIAVWpFj-fb7vzEs-TJccy2wBdbHf9Ec7hssvSnPmlJEuUvrbIG-p5WIXt_S-UZ_hGoJFhYCyZKICWye_FppDqU2cktMg9KJVzOr9y9ZbUmAFAyLhDpZC3OkpulmS_2kMQfhztqrlTKaaPyGOS-Y6uZwZglvFzM_NmSeFFN5s1JIm2qSmpqA4z_BElD0clC0X1jmnoid4mY7jSQJHEfC2LQaLUJfk1kCPTWK--OqMlSgeSZWgMmfsGrboMnIgAspsAqb3G1uMJSeEagSwyMAPNucuTcJrKlcrL3uZiZPL4ZWeT5iAyeYAWRIvM2ITFkicB0YlWsQX3OVIEBC1xH_V_MYN8JDP8nXV4u4dYdbNOJnHN9-pWuyARHNRO-0oesguPZthb45J3nPOP9uvpvX8tO4hiysn86K66iBqIg02KGMjl1F-pJFvPOg53sHK5Ypu-SA7rF9BDXtYlohyffivQYCuhuxlsPrtGUx87uyqsumuKLyEP9JNWCPTNX6jmTT-14kafQwVNa78WB4a0af3Heos-cBwMm2Kvvhrj42tok7owb5jRcpTf2UYyrECn3RN3G0mfn9xlkvzwkU0aL2nq9uzqrQJfUnhkzL9cLyVZA6Ph3gy_AC1WymrxTmBNObEfkuc0rd_1J9npKTg6IR0E1rmtJlFCo2iKXhIXS66EpSJU5RcSNOqV4D9ptgNx8PFxEwPMZd66gI01dSCgZHRJprQhgDY0XGO1QFHi2UBlEcRFV7sBGhf2wXNDC6NInKyGzhMUEwl766UvM49GW5c_t8f5aZgJObR1SgHnTJBF8ZJOGMseNPpfFGRg7TQ5e3W-O9wuGAgTwmJtUFjnFwhbt4DWLGwMtjmv0bSf0ClAMrkbIj0FJLr9W9oUFycohzlXix121SuvVmkfamnx_4taJNnaIkS3CpU_HcTnEa782RhFd0qg7RpSp861HZ8si4_eqgyfYts5FhlNfAokRvUu0a2z4T-HB68M4J7GIVpmmSwMWf2OJhlAIO2wF_YB89nYg2j6ESL2ysQJqmS0hpQQgPmsqYI5RXFvRQHAaeu0zh8YxgOrhyxQeNpYaD6tXnHP95B-TNsfkJtn9ETgPEHmVhxb-JyoqfxhsjxbcJHiLx-FPQpaecTKRRsmHcVvimuv60sjPae7tOCZZoRPkyN9liUKGbJdPOHGI2S2VNm4qIGtmMBjIGqRkHarX4HOZuvzhhu_wT24TbAIR3rw1C3s9EbFac1IE-A421xbyk0UOq9h14FI6tJJq5r1O5PFkG-2I_SMTSuvk09xWY7cieMFKPsDmPDAbNY_FSQhytWC5gQJMvgCP3w8XnxqqTHnQ_ucy3WmqAdqiYFu3P65GG6fTNjGPOuLXzqgM-HfUAYcGVqGprZ_oA8jF_XfirWJVhnBeWxLLMkCNRNFf8Jd-wpZfLqRwqeuYq_b2oVTfxTKa5iR1M2f-fTWRbg_XB-WIPq_ayG2HADmwYEii5kSup0aOA-hUVhgv-w8rjWdHXqV-42S6-CNwFtJCFUyPyUER0gN4QdAuH7LGcvylyN94ANCdmOsN4hJ7nKiFnba_iTgqqbhUERdKVvxcQ5FYpIMfGjFM0336bzFhBs0UFBSZtp7bBJn0iVIwkJo1RougP7EggYcQA1l6lZ8q9Y-XO1qFDpyBOhzDCAzFWQ5svG2h_6kzv0S310OBtfgMoGmFjf3PjrJ2-oC_uoBui2Bga4d8oXWTE8bYPr2E499OQEqMoVCdjlvWk1eeqqUJYM7S7gkWhgY6XSW4q9HZ44Bq_m3vDzEFIde69-R6aF8EvfI8jtARr-yiozx04d_YqS8Oe8u0TfH8yUhMu242qyVpKilWc0p781-EpzFZUF4m6oefY-1jVYWuBp5zxrSHi4OrCYs5bb8qerP3SBW9Rit7Cy115os8gigFc5gV6vyNdPF6dtSSi_TRN7UBxC9aytnqXUeM67CkvuMU4FvNrfqEqUPIxoPyLQi3FHXqMPW8PAZQ2LLRIA00mq9ubB8SFA4H6RTjDtiezy6HHr1lEVxmqz4ip9OA3jP1O9XBxwGarmLgwzG3n5wRpEAmBQXpC2D5iFZB5s1E_87Tc7GINbOB_O-J1NDIbTpCOGfjuqlpagbBXL5j0lag_xlXHY77fFP8u36i9FMTSV9HqjUUHY4gF4OmhbiwL360YoMkdBuHhHJbCrdMaqkamHbUL1AKHWd_qvdEZs5wPiLH3RnQY_aB-c0DVCR0t2Z5pnF_sX-mdS_YnIV79PCTOsd-7gv8aaVfrbNVlODhVvVSK3wicG-QJKxGRh5I8Pdu_eCISlVdVbEqK81MSflBBZqgZx3crzTnl7ZajxzB-O6AOr_92iD07kJViNSj5x-riqxc0pWmbCSci8LXXmneX_E9z1qpvkzrki3gA6vRXVB66Lvor18VkL4s2Cj8kBF5I1z1hJOsDk5Sz0HJDlb_kKG-UbmSInRHQLLsleUrBGWbuVhoTz8-Xxa7gGc8vUzgjHkOaRSIW3mqjpfS7q-VJ4F96HLTYnfYnydf8AxrNUjPciwfSatHarYvxWbuDO6WO0qjDt6oPJqXI0TNFUwQoLFtSUs1LIOunXv_jubNUkQZHRhnN5LXcvCWjGB3pVFtyjvR9tqI1wrB5lZvntBIe6Up5K7GGDNbMBdQEgO5xThNjb9rlmMLGoDpZTYRvLyAhYysa2ZCEyoQHMkv0WhEzorunNgDmoztfn8dg4_AzXk_JVKoLG5fKzatEkMIT5pFQi1KmXtTFkGUSzYNU4Q7O5k_5Az0FsEWfwy25Zvwf7s8crWAuyp1rIh5RUKMivTK-Ozf7jRsdaKEQ50Dw33nOP3iM6AL5Px9HwmgrJAe1pbEGzouv73Ebs4pYUo8tlzfhjYSQR7JK2khNlxYFsECdd2oocVyzdZjwh4b3XajYG9QkfiIM9kEmW7LYXv-RgZyzXnskskXFCV-l3-u34m5VkSxu9hUsksLzWJJ7W7CQT3mmUAuqf17hEtmmNW5Kx4NmhTxN0jAD6sOYFuOFRjiLw1wX2T7PGIZylwlXWcRSHBGkX0-v69bYcEhliJBHjw1w0eSXLN4Yhqv-cYdVS04oE9lhYADLO6DtMBWN8fF58M7oB6zQJwDGQLAOTby68IqOQFdC2WeZFChhJ44jTW0-j2Yp7kBZXiEZE-De57S_YNw-nKz_7tubGxHQrz-T-7bXHngDDitVlf25D8al9jSNas4o88yS_Cio5inedwPgKCgaL2dgmmpwLolB4PeAcDijzrV2zcDyUj41M8QqYRjgdpVlY3orUaoq-QcNzlVTooIOUMRNOlvQdlFmvAst37kYT7VMI1CkjM97NBPsgDKKPbC0XqkRyg9ljJ8nFvkW6OkzXalsM2Y6Ds56sDk7o_-uuXaWFiKxbqihOn61OU5DQTkSNzokC-RFaRnFcwlMI_MZMc5o2-U47YcjK05_I_o3EEaAGFsyWh4U835IqEeY4usOL-2nbJt3AIj4XcLAM08L9sLrgBYjPNQpkQ7hVO1JfrlbPC7FjPXxshkguAItm7CNLt17fh9d3jyg1VtPb2fpXlB3HGBhu0JrMCC2YNmQ8TzCUbNBD49ARMibd5AEstdXHTTa-gg2dMlciB-7WhQH33krfsFOcFU5Cq-aXl5o58PflODhmRa-gUl3rvssdc-hrk5m7fhit-mRSoZrDN5LXAHfqOgaKOsa09jAPXRbzr1QqVPMcBtp79nk1BG9UbZIKYGk28cJqRqWjDP6vBpOCz2jXkWBOgiVGBoMy_xh9SJyLG6rgHc9O0Pf56dK4ohmxPnrkwTuaSMm5ycjonjT0Rqt2vGMH_A0uwFNvRURYceBYZ9rEnvN6sFVz8t6K4h37uu3aO7defkvPLfvbvnprm6OE2n_hfSMhr2Ze3utE7F9gBzF1E883zVhOsO4kzW9iVfd7hCkoHXmF-zzIGgirJAbLUNJYmrYir_gaujDbU8oT15o0SBxKIKU37vrvK3T36xPb8zfOqqO9wfJvOGwKIO4JhIpirixRkDr3kVXrTB3WWMcmqqAvBKo4gfgLX2XuxmKeqN2QFpH9hHgNnnTMavVEyxvTuJd32ZnJfLvQZ4&cid=CAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=15161106222873354000&adk=2228999114&idt=55&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7C2D 41 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTI2MDcxOAogIHNlcnZlcl9pcDogMTM1Mzg4MDM0CiAgcHJvY2Vzc19pZDogMTMwOTUwNjAxOAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 7C2D 0
948 B 83ms
43ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTI2MDcxOAogIHNlcnZlcl9pcDogMTM1Mzg4MDM0CiAgcHJvY2Vzc19pZDogMTMwOTUwNjAxOAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxODE0MTQzNjkyNjc3MjMwODY1OApkZWJ1Z19rZXk6IDUxMTAzOTkwNTQ5NTY1MTUwCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNC0wMi0xNiIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc1ODk5CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDcwNjcKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMi5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQKZG1hX3Byb2R1Y3RfaWQ6IDEyMjcxNTgzNwo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"51103990549565150","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"18141436926772308658"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63CC 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8310913412201&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 63CC 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8310913412201&version=m202401290101&ct=77&x=1&cor=6316467786581408000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 63CC 34 KB
19 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ALDt_tQuoqB3fMBx3F-lGsjCuEoiTVkI9sut9gBFneptR2sALayC8NeKTQHzVvo0KNE0dfP-pJf9zvuA3yhqsvCJf8cjE5uH4rbkgv6VrFJebh-0DuAdn63Gyx3kMDdR_9uocgYaGMngmetwgK3EQrNZNlJJvoCpdlP3K4ECxaSCrQB8U&cry=1&dbm_d=AKAmf-CaoIYUEpSEVvqHoolC7DBZXK-sFDM8AsocsapjzWWJo-zCLx6Jjj20JIzoQSTE3LYTl1dJ89-_EDA5kBIyUSVYUMYcWn2f1VMhWvuRKAGuiId0igvtzmPi-wrixUewib3LWQEqJ0dZeIvki5vgesPAl07XMJ5YlumwVadmC41tQH2KWfGeaKBHRXQHa4_UmU1FfrYvXoD0UhZKiLHA2aA1xZi4Fe_NbEDEi0wvTjW__yIjh2UsXgZXSeY5GE3cogJVORXa5i1MqUqg-dmlsS4AwW9j6DSPuRQYFv2rZxMNULXsQKWQ_6wETWPc1NsJrOAqg7QdHOfnHklKni9qNW_TabE8CJQ7qg_L6Cqfdd7c_K3ejTGqEcw0_1X5Jy7YAMKMZZEHbq3dmnW9eCAspfOE6idNeVXfOKD-KGflrVBuoghkpAhJ_LGvaQCKUJh0pc2-kkwlQ6l4fsnJJwVy-c_bMsdxHSPEgA3X8pG0LBVM9agyN0Z3bnWEFZAIPiJsErTLOC-ypfK2T-JKAgwYq3r2MPqTFIchXkxoRCiJiJhlJrT7cyZiA3Y1AAD1LElTTLyaikx2sEuyrbOnOY4z8mpcDg3APHPG-EU68wYUiOVIOySBeG9OycmmwHDj52DR8werTkbmPEz5Nig1-K4s9jLxpBmmV6ySt-wriJSHwI-mFyxgKRHUiuLhkCmeVXdZWDo8LVP0nAP9XEtM_uje0lcWJVfGodqYeCxIuALrjvpZV5eUPmt-7IvMMIdfLEdA5mh0zX6Xqm4NBqWywHszhbJcHgez9cdWqvizI57a7GtASzlCthVzH0UDHJAgdKJ9EXtxGSgClbGYz21J-GbJ18OhX8WWwb7-sw8mKLZ6coglyubdw4monx0BR-3nNdGZXdb9u7-OARf-zYw0Bh398d3XJVhzWOEVUum-Ubqn2HKZCiQQQDVHUxQX16kT67lKDTQpf4dUC9JLXYSqg4_7CUYGkmRDe_IMau0yTy5fJgwwGoF1BtzHkwF6dxFNLI5NfbQbXJBbDzh3ztytax4AE1fk2q_WG2wBtk6P9ZdRuLOOfvQUDjnp_9Lx6YFBXk50WKgg_Gw8L1Y9KASGLF-6ekaPHFBEpJ0WJq3trmhqciUPwtyv2dH6zsuoAvXbaGINHnxlQTjhnDVk5VhdeJBIheA1GpG6ixZENUYSbJU3ddlw_OoLFrVhoRxbNXvfjrqz8F5jmr-1jNXwvFitCxkdezLvTr_3zNKgmXPVWinfhfiHDEM6XptDPsFZSXDu_xt8a427RkpQsrVl25gD6DqsR7wBW44yDHjymfkg8kEyyqbZGG35SLvgMZUfN9PNq160MxNk-oa5Sa4jdQavogtxwdje4hVgEPsrsbBsV3Ez3iQpf1Iyd-zhUcHNCGKuOdU3lanvZaQ3XBhH_4HzN6mfqHbyaxSUCYkAlQ7E3azWmb6sa5_dncdp6aLk3KuYbdAdH50pTk2JaUbIGLZBAU44wxyQ9dHidcN91D_LgaoV7LHcoTLUQZi_BKxH4v6K1lghP0DguvVl6juETQ-YZ4KAcvddC9NT5_Yb_kNpQHf7tuN9xA80rFynyC9VK4jT684AOBkCc9Vv3v7BR0nXs_PEQiTH0loKR4eVkJsGWaRGj8DhlZ9EVAB-l4VsawuIzUS0YPWuEby3o0myudLY6EVAfmiENA-pTrxBIciXgzqZ9tZOljvTrXnuONF7-9vDHJHldc4K5RK1R5XFML1f-Z2NUpoLz2_YfnH21SOWhnJ0hHnJdITr--VgT71C1O9Hed9g8ShnIJSK5IU93Ji34esdTpWpSMj-wmBubnLCLFm6Hcbjb1YyyO8WvRurFFEz3LmPvV5UWshuNPSQA4Am1GEk493Ca3fo71ggdZdvmkOLW3Uv_MH_doq1-3og18fXmppvd1TK0-5UMBbMQyWUwMDdljRXOLZsaLiScsGd-FmssI7Ria804rXBDGSLQVcrIEZQc1GfT2URv0AA0014c7AjCHdYmdanJAqob-un3PxFyG3SEtEsfheDlaV7lvPB01g1_Gat3rco-aZyprKH8isMIhsdligjr-xytqObd5-qMj7Rz2WaqIDa9khSXFQDqZ6sK35ZRJhUMnypTHsMHbNQOH7hmdMn0UsydXzEnSYYWumF2hd3nbdQSwoKPPMqirDBoAvQd2dF2E-5lLOPWpSne_Y9QRuF5R3XUlITsPxU6vriI97yMRaFCaRHkBmvGRB-9HwcQcSOKLkXBWjdz2cs7VdN5evqD6nNOZL6upKsGAM4qLHSuDYY-LgKdYfKad921bLPT5paOP4I6Jyuz5z5u7mJHzv2HatlwnqMMJmW4I9NvTvf427etTA3S-u2RwDCuaGDq8AIdE9W4LFeBdaH6gLM_HC_OxdTj1S_44mmUm-9debQdDPPUe23BZNHO9Wq1iEYcSpFg9zORs5FEyztadr5zNVPTiW0VA9bScuFtSIHHNSCKFb4bin1B2VwsobBUv1mCSi8PzNfV5F5I0Z0Y8aXQ5aB1NhUHb7u8NrfSsTzDhn9jtpn2SnvBcNN2WfhiZIQ2JqBTfDHwttPxyvi8IbKgEEV6kzhsSxLlK3qj2RCtG-4hwhA0wl1S4-liUZWh_IKAiEONqGLrdpE6JnUli-PZ1XxmsrEjvJAPLwV9VNOezh44cyPzyix1s5Jn8oGIgYjO70R7xoooXCZWkW5z3X4jlzP9z8umnMi47zzmewDFFZ97sWP1SQoAoQtL0GVTxkawrd5ICRYICKMTTuzvW9bcq6MFGZvAlTIy4i4llNtKUDflq9KrnXTiLrpUDjdGDuayzpePFTUFi3vGicyRcreaLtjcEvB48FtuCF3YO4hAgKaokxiMWqY5RsKeuTUf5KGagz0NrK4bNyL_QeLCJnd2iiPP7faJ8kPaCEnjImGSiOoVexVd0beDKYc2XD6Sc1NseSb-SQC7RgQDmWNKWBBbjSASyiRsoVAtAD6_CwWldfSVTazinAHQA-qYHE93Cup4VVHuuwttTuuA4qysXzqBhgxdoeXMgFd0vSGiPHUAnH5MUecfum_4oZ_22kd_beho7arHuoRnl023NcOoRjC3TFCQT09ePMx_QbzGehELJsH8Aux32bDP6X1gvYTQ0nNqNqrFUILg_1zo_-KM-eowqwzI6XwajN7BNReU7NzXOARwaMpVfUNhRieRBdRqmkWKqprMowRUK-t3s4xt3gM3WuVHoo5jEQb75U0n8Geiyl-F_tCaezw4Wem_RMr078o2SWjP0C-4iUZEmVO_dmC5CCXrRSkpepBmaYCe39HY_c3KpRcPTm36cEOaN31pmnroBREBjNviaaF3MCrgSaPVbNARYfoSuyee89D3ueuT3DxHf5CfkRiVHQPMzGxBI2yC22E_1rc1_bcSgyBZvofCkrDzUQuTP_ozfYzfZ7ADEE_nA7K4wnZVWksRcz28cY7_28674xLFEvu2NQtDcN19oj4ZVAoLJKE-entySzSMB6UAqMhGFRHWuQtHvQYVuw6wfMDJAvhaQGtNOXuBuYhJXop0XWj7zgN0fi9C0BOcsx64lasFNhJmvVoE1rs0GkXpKZnz6Y2aWnm6q_F4js2iNjtaOomV8Lk79uSGXPNyFzB9qDqbsTfSUOzsTMPen5UL_OtFr8o8_gS6G5wxNQ6xsOZXjAMY_lPjMtsrTcs3tjq95b2u2WGL95_JMpRPpU59wVnDZAGeMe7Po_6OVVvM8tf9w3Zsn1a5xeRPiWGjo6iQoVC8RAGD-DxnNYQ9Dy0O3VY88WGZIT_IeiNyGtJDmVg5AgnpiuaicW_Vo93YPmzSF8j73bh7_jHXz0lVuG3z4YcsjlUqFEp9XZhoHTHylS0LwmaDziZ_mKxY-9NqI0MZQ02PIVBDoXqQvJ0WckpxhP8dvxjyTFO_SAM6FK819z-IgvwOeMIE3DKMBEq0W1tpGCv6ovIAZG2FYUXucV6wogW3T0Jrkam34TTrQtXFkYbV9b95xM0ZDFOaWAFAx6Bz8PD--cZcnYe2b06amuQwNZFlCAEpG9wAnEJYKGgVo9wHAvsbSBOU3vRHv5bZgSB3UaPkdrIe4zSH09FD_y6nh-1oo9JthJaax5v6vLgJUqqcrUs6JF4mzT6ekFbohzNfsEjz-yjVucHKRK3LGLIKeu4MdSalZj6iY9pkdEKrpT_7uaZZPNy6BA0yKffGoyO9KI&cid=CAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=6316467786581408000&adk=2086295848&idt=54&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1193bce06a26c05dcb1dd1c23e9164b32df086fc5b488c2691758364b774016d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19754
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5A85
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1

43 B
733 B

35ms
34ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUWYxV0zqJoLj2I-gC6pnvkwFmjdSk59RskReUwzoSXMg_HCy37Xnj37ABS9qFslW0ZMDgXq6TViLSpLfvPYrZJvOZMKRpK7iN6Q89DiAswaMdGyevpe2KbNMRuGdUZcLRHFxw156ETqeVdwXOdWKiBcRIHbPmStF3dZ_PXJ3I9Jr6uAeY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H31yuT9LZ5wSANmFkbDcSVsQCufc3FhS5DOPrL3DgCbuDGkZIUkzPZZySobXlqguR7da2qg%2FYvovdAFhGAM2l%2BAGA6TGAIqtXCaPnNcj6iH%2B9JzWgUmo8jzQvQhoksz3lp5xd4nu0SPm6g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105abc339191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5A85
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.yCVVbLWsAABt9ANSwbwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2

43 B
732 B

33ms
33ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUWYxV0zqJoLj2I-gC6pnvkwFmjdSk59RskReUwzoSXMg_HCy37Xnj37ABS9qFslW0ZMDgXq6TViLSpLfvPYrZJvOZMKRpK7iN6Q89DiAswaMdGyevpe2KbNMRuGdUZcLRHFxw156ETqeVdwXOdWKiBcRIHbPmStF3dZ_PXJ3I9Jr6uAeY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=grzScYSqwHu%2F3wLOWRzSnOtrwjMkWU1XXnzjOrbrmle%2FGhSzwvs51uNHiLRyx43RL9D43mZcvRcyLfHiYAo7LDENyCCtkYbKCv2TlWXSioB7akCNcOtTCZyFaJDk4AQ2eXr1962dgRtjsg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105b1cfe9191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 5A85
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

43 B
1 KB

18ms
17ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUWYxV0zqJoLj2I-gC6pnvkwFmjdSk59RskReUwzoSXMg_HCy37Xnj37ABS9qFslW0ZMDgXq6TViLSpLfvPYrZJvOZMKRpK7iN6Q89DiAswaMdGyevpe2KbNMRuGdUZcLRHFxw156ETqeVdwXOdWKiBcRIHbPmStF3dZ_PXJ3I9Jr6uAeY

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: ffb75a0d-3b08-4b30-9b2b-06e39c9a29fa
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A85
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 4bc261f3-f771-4c2b-8650-a9ab87731a7d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0370
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1

43 B
735 B

38ms
37ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGIW-5fgBMAE&v=APEucNVizO5AeMhzgJO9aqAtyg8K6PY68rwpY8TxMtHRqbpPh1rpLx8ro3UY_BSWqhwuyWzrLWQIIWsAioNF-ZS_JukYyA2wwOCaUNYT-L-CW6RjpHR3Q1IIYKmr4xoLwvsFO_yY5zk2QmlgC5xYYIkY0IBeijQLPm0GfTGTZ5dlJDhTDdFcNEs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KRonNCapdkx0AjRSxN51yuOn1fCdBXdfz3NE86wLuQdO1tYQx0ZsmReXECbExjqR%2FdztPj0EhsQRdMG9eI%2FWyfmoPGZk%2BlZYDlqQOx0YF7QsPVz6rLetmtSLMablKIdx04%2FlYw0bAnqByw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105adc799191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0370
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.yCVVbLWsAABt9ANSwbwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2

43 B
734 B

30ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGIW-5fgBMAE&v=APEucNVizO5AeMhzgJO9aqAtyg8K6PY68rwpY8TxMtHRqbpPh1rpLx8ro3UY_BSWqhwuyWzrLWQIIWsAioNF-ZS_JukYyA2wwOCaUNYT-L-CW6RjpHR3Q1IIYKmr4xoLwvsFO_yY5zk2QmlgC5xYYIkY0IBeijQLPm0GfTGTZ5dlJDhTDdFcNEs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j7jHObR4kBcPJ64ZBgV8lPvQgzbV5m3EdVMxAwRdLZfPbsO2ssiqPkawluBMmmhDB%2FVyath8WjfGUz9S274XXn%2BroJgOJ6cWgy%2FJXMqEvDbYFNyl9OcsBcuzBXYF9t6IKDIVplQLVRWjoA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8568105b2d089191-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIYF4MAFVB1T-M1pB8qGL94&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 0370
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

43 B
1 KB

15ms
15ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGIW-5fgBMAE&v=APEucNVizO5AeMhzgJO9aqAtyg8K6PY68rwpY8TxMtHRqbpPh1rpLx8ro3UY_BSWqhwuyWzrLWQIIWsAioNF-ZS_JukYyA2wwOCaUNYT-L-CW6RjpHR3Q1IIYKmr4xoLwvsFO_yY5zk2QmlgC5xYYIkY0IBeijQLPm0GfTGTZ5dlJDhTDdFcNEs

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 34ec5b31-c2a9-4084-a763-c1084cc6ebcf
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIDbx4Jc8PHPQWuiu1HRQvE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0370
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
an-x-request-uuid: 117dcf33-8f2d-429d-a226-ebe4c1c881f6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkzMDU5NjA3MDYzNTk5NzczNQ%3D%3D
x-proxy-origin: 81.95.5.36; 81.95.5.36; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A70C 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DoH0JXuIB-vIA0M_BVN_0Gbj8jmzrFWsebrcISKlEFt29XKiNX2JpKPxB6gX5r6XJJpeblauRHVyC-kSAujD0mceCQ63O9p3X0OyS9ki9GYJYnPdQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A70C 93 KB
33 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame A70C 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame A70C 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A70C 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 97EB 466 B
238 B 54ms
54ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUEwFyORpQmGJ69j5T5FiLY7__LfVYomPS8aQBVRVMGjd8hij1daLG4JFotdp4Ar7AtReo_bbg6QnVUJeMM22hdaEH1xbI2237XC52lAvXGgarATIoKnjQjwD802yeRhqXXQo4RO6XKRoEl2NjXnngBaFOYXGLk5ZVnpDXLbIBzPW5OR4Y

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 2E1A 5 KB
1 KB 46ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:55:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2E1A 205 B
296 B 37ms
9ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:53:15 GMT
x-content-type-options: nosniff
age: 241950
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 12 Feb 2025 23:53:15 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2E1A 604 B
1 KB 36ms
8ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 04:03:39 GMT
x-content-type-options: nosniff
age: 226926
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 13 Feb 2025 04:03:39 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 2E1A 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e33434b042c688fa1972d51e9c103fe592fca7a4dd50358c08449c7b0f5cb4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 19:36:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84581
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6487
x-xss-protection: 0
server: cafe
etag: 9214289930287671984
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 19:36:04 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 2E1A 22 KB
9 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9578
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9141
x-xss-protection: 0
server: cafe
etag: 6041988417631582345
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:07 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 3FD8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELHhhpaH46pxGX3SYTcTrJ4&google_cver=1

43 B
105 B

17ms
17ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELHhhpaH46pxGX3SYTcTrJ4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNXGTXP5ZjwAy0fhLec2xpKUn1ZpUfRmYGcbIJ964ZJFKrealc-a6IwPhaHc0gJXMXw9ZNc2gTwGlk0If9VqfH6BGxXWfgRDe0MzC-mubPEeGyMPnW2njIanE-0UzdPpK5xbw5Rsp0OImtbwhUdgYsCFczlH0lFlibzg-3HWo12Q2VdqTzc
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELHhhpaH46pxGX3SYTcTrJ4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 3FD8 43 B
295 B 42ms
17ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNXGTXP5ZjwAy0fhLec2xpKUn1ZpUfRmYGcbIJ964ZJFKrealc-a6IwPhaHc0gJXMXw9ZNc2gTwGlk0If9VqfH6BGxXWfgRDe0MzC-mubPEeGyMPnW2njIanE-0UzdPpK5xbw5Rsp0OImtbwhUdgYsCFczlH0lFlibzg-3HWo12Q2VdqTzc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 3FD8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELWLOd23LFk4uOcTSHssn5c&google_cver=1

23 B
163 B

60ms
32ms

Image
image/gif

23.52.181.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELWLOd23LFk4uOcTSHssn5c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNXGTXP5ZjwAy0fhLec2xpKUn1ZpUfRmYGcbIJ964ZJFKrealc-a6IwPhaHc0gJXMXw9ZNc2gTwGlk0If9VqfH6BGxXWfgRDe0MzC-mubPEeGyMPnW2njIanE-0UzdPpK5xbw5Rsp0OImtbwhUdgYsCFczlH0lFlibzg-3HWo12Q2VdqTzc
Protocol: H2
Server: 23.52.181.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-181-90.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 19:05:45 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELWLOd23LFk4uOcTSHssn5c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 3FD8 23 B
163 B 52ms
33ms Image
image/gif 23.52.181.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNXGTXP5ZjwAy0fhLec2xpKUn1ZpUfRmYGcbIJ964ZJFKrealc-a6IwPhaHc0gJXMXw9ZNc2gTwGlk0If9VqfH6BGxXWfgRDe0MzC-mubPEeGyMPnW2njIanE-0UzdPpK5xbw5Rsp0OImtbwhUdgYsCFczlH0lFlibzg-3HWo12Q2VdqTzc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.181.90 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-181-90.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 19:05:45 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CFD9 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AYhoWssWgIVcM3n0SrZWuOFPPb_MmppcEdmohmmLKiOuaUu9jUp4JLQ5Pl7Q2wnKOQ5rOEF1VUS93iOrwwg7lvGCv5LQT2drX-vijAv-VT7P3f650

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame CFD9 93 KB
33 KB 141ms
140ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame CFD9 3 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame CFD9 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CFD9 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5712 398 B
225 B 46ms
46ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXNsaQCENrtytQCGPHts4cCMAE&v=APEucNWGjFyasfJANT_PXZxXohGBGLi9jelcYuY_giSpoiXYmlFKjFIeJwo0WI3rCdTTentmpS9gCFyBJ0oJ3I9u7txfDLWoBZEMAu6wjXd1hGTYfYICGr15xja9EYQZmAxIIqWswO1M4_l3ILQF8qAib1ppyAuQmwpS8yYnLaMU0EknaCaO7OY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 73E1 111 KB
39 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 20:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80549
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 20:43:16 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 73E1 8 KB
3 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:23:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:23:38 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 73E1 23 KB
9 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 08:12:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 08:12:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 73E1 41 KB
14 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 73E1 3 KB
1 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 73E1 20 KB
8 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 73E1 42 B
63 B 42ms
39ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DWOHMkw5nAmjJU5yzIEQ484oE1ptz2vltaAbCKWBO7UMVx55onlAftw_iyQlLsA_JkR9Nf2o7Mewi1CkLtrT9iugA3klTME9Bg94p-HWcq2BC25Xw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 73E1 204 KB
61 KB 14ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 7C2D 11 KB
4 KB 35ms
9ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344786947&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f30cfcaf5363b793c3ffac0daa2a21ab7055c1b6ae1222d75f3d45f8beedc599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4203
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5C25 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame A5CF 59 KB
14 KB 431ms
34ms Script
application/javascript 54.171.253.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATspwKcGU3o60sTvomq8f55xKaoQjaCJ5C1v-GK1ApOvqmCQc-DJ7hXcXDExmqE4PuK0a9peSOOSqwoW7GBJJG6hQxg7EtZbdXAaeZ-xGZVKi6p0haNabdkHq2_jsRjBZQ4hGAcstQI8KfLlACuVKjqv_0YqvrKPQeA-mlB6KlPirfhZZuJUuOlccTewuabftnjqnMzxxhBsmzqLV2hdBy4Lvr4cK5biO_AwTwGm6BTMqCsP8&dbm_d=AKAmf-AlcZWgEMaSutTn0LAj4ArmLHnFqNH4aDyGuwhrSXrE32iBAzWg7-pCVB-XR1ZRJo7OfM9gUZumR4qw4DrfW97thJfQzNV5tzWfX9JPmcpLZ0s1LIq1DYl-f0EiBMta2_AFeO4Vpm9DPRGonu8rVlL4rxHZa5eVYMMBYgpdpQER2blCXPxXl57isd5ahsjJVIBReZKxHB9nKnzlWnue6P8poMLqYtYRc5BDeUk_bqmRd97KZoaG9YVvB25ptAgsEdTcufae3649U-6mRZFZt0Xi7FF1H7r8hAtuMDHzL1BTcrXWYapnxTFXILr1OqVunAwQmCLFB-ML_q36Dx7MM6TqS6BxDuCofqWwdsmBUr-RA07b5V_y8-dV-4NhkZ_zNkTRu7_xHucjANFzUTphXP-O8LSxYVuJdfviKHUkdQMStPeYKqPZndbAzRDgZlauniuy7Hc3b3qGoWYUBPqZ-XQyiSIr8dH-wi1BCyH1WeUFXd1CBRtYarsL6uezdjpXRqMhN7tMUGrEnE6QgHvefRCGyYhaDTjDBn0MOad0uB4p8J5T2n7OFIkHnaER6gNBIorBs5PPRUn2mbgj3AWXOTo3FJ37FkciN5rBRpTyNAjembj5X3ezwCoXnY6F_9ylI0pNU2fbK9V5QJ_MMVV6e9pbocNFlA69uqGKs_uVVJD_qGAKLsMnBJdILn-dedG84jnHMxA7aMTiA2GTGW5X93Lfr4Z3x0MGSPalBBSto23twyI2GQWP_6oY-1PnnULih7uE5IqLdIyXwCwCT_n7udi86nksGF2_XhAd9plzT-odSF3X86sqJJfXfgEfLENLqt3u1h7zkIVg4n4dKTox37xej3stmlwY2iyDl-Ry1h3xcaVtDncm1QeHZGLufWS_elHvAPt0Zb0fhGVGnMEq5D7A88Av_kaUydutQqlHTUponOeGegbcSR0ttOh89hPxTwwgFYy5FQ6CH2zmSaWXyIpr5b2pESIbhUfASTfkTI15dfeYQZonT8192Rz79hblRaIs11QZt0FH-SOkYq6IavqD4Rj745WcLHCUiRSM7Gd_NdiOygcTd0cmnh_5_t4uwbhMhzc5-IXzAj1sNbVPlN1Vekc-GOseYxML2-3h3pEN4-mmWqaBeryro_kpLHmVXvhZaoIlG6eBjUxF8d3jcZGpkSQDZC8ofrpBLy1tAMIpOS4HBKwckccV1xrBuM_3MTK1vLIcVDJj1nLkmH4PqrAfYmdRcbYgm65EMuZztPkYpR1nxA48IVNuCGiVWT8ovg3k1o9zSN_Ppqp-Q313QTBd8CH9cVsrtiuBJEJoU6-AGXbYoW9LZZyk5Q3ev2otPbZJL98zdT9w8dWqGzu7v1ouCLPH0V6xWQTjyf4vZqSqJmrCNht_Jjf93ZkKSM6O5VkCz9E9kDxMvPbTYngunatIb4SEvlnVbztTH_VdU0TiM0rdVBAYiRyMMPaZ_wEOTDxvpUF9VqhtjBK0Lhg-QQl4L9ZUhs4kMJ68Kcq_l4YLtZPyI4qk4Rq1iF_GjiR5ApOEVqNrBllX-IoY-hFysvQRVNR0fUWFbSpwRUakDiN2Dy-dPUJJOxa0ji7ix4rQi0lqhLon8MFK9QGmNM0IQCQ97FJMjPj-qK9Du_Qy0eDd3xP6omP74Fcouv05l8jndkEmv2YtIMaIjW_wO48OaeZ80QHVHIK3s0eQz5zhSOTMenDphAuo7p5vlCIiR0Wj0ja-_GmhKc73TMrP7GbqiPA15OUyQR36q6t6AM5Yf3bDuqAMUu9edsJPD1se2-1r8cke4r9ahhTBivo3x9Kf0yT3Shdls1UWhPxjG5XbZAxwFmalhdiRID6AvbHiH2HYiEWdju5zS9oRw-BwlEoxBxftuGn72phoa3YAGGGwWz1gaM2WAkEnj4YncthRZVZfcvATDfu1jdSNV_R6EhePJ0t8NUCb4idHNGGJB09iVQb0OyJUwfqXIcyLL0EG7cRMvnyn0trsUhHIhJXpucwjHzQisZKqxgK7XPliqxqBBqPHFmAM6r7ZIapGg50gDROolCLROay2QLMHBpiepDZxm7xVrbOxslJRZiPuTKyUvY9pufIpYmnIRwH9DEUHPzZsFj1ubEYBfJwwCcAH5ep6-3K7WIIJAFbMpBdUP_N1vtYKJYEIZkdoOazy1tyhCDoPEwmV7H9KEKuy7myL0LKOjUVcM6T66tKqMtoG6zTOxvxC9EAv78whYLR_kZxfQL_7mwGoMqttCuZfQTqI5vG7wJxTQkYwp5I5NOJwCf6LB6_UESGVocFjJs_2Wo0t1XLAfV218pGiw5xe7PBsgW0BdVcMt_XL7vN3A5WRDPdU3gQneaRrNHFkUhy2LT5SLCADL3JHOf2-_7bIOGrusM-C4AoCcd26g_OXkodBXlZa3tmsnHb2RSuEOvhUYyIshMbPjsHelb3n0RRfTnGWRddrxqyArvsDBHH6LR73RbFRSef_p6S6UfKeNMliOT0Mo_Ox1FCyw8Zxi92-zrpLuu90DGMqtqvI525srv2EbbqmzrXleb-oQ9Up9ba9NmJACCkNuIjrBXuTBnECAcOeKqhnG9SJpRjBMechTAkAMWM5jicSo2VphyhaGr2QR87DkrNou-NAvx6hrCYKxOPMydA8sopEPd57XHVogFmbdFKynD8AA1ZtabTcjY6PSy96rk_zbiOtAq97c_ZfhMufYRoJtGgk37M2F77aciAxX8hoPQN1qCtD_Ebbpy3f0tvHQXPDqpDSRzDbGXKlFEu-kya_d_uymnNpR0q-eyLiJu8Pzgzj_HCNOg5D984gMfOBbABPfG-WbRogvGH5oIVYEz-e0GYiKSGN9FpPBaLli3VCUxjBw0933N_WnyoIMxSt45UKM1PwujWSMpbfui6bpjV_tPYkWjOMl8JkRMLob-TbeeUYqdnfFrlu6DnK1dXLabpYwc41rm-OQQqpmI3StRNi6ngkB2Z0fzVypr8yI4aoegFQSyt--VPFpbWHV2E3_QS4iUpcoYeOjhxOnarhoJAVtc9zLfCop4y2XEcD4A6u5QqjVxhPNtz34OkUVha_Tt8AScBMHlmf72PD_iXK2Nqf1KwFXJGHOtTtNEat6yKn7p_rCPNfpScR70u1jabdHnh6slj8J0bpJZRMwpJ5sxv42zXLl7xeZBnF-U2YReROhMhmWSj5jaaC_14UBDeh11rebzsu-WUCfOhPM9CksEdSPpd5mS0n6SzAld8j247lxfGXISQoshpTEexx-JS36ZKBSTpj-WED-DvPPDgLg8Z8NID_5SKA58NN2498pGNM7xXFD7OrZvw3mmCFLD9DSShMub_X6_naM2ybTZa4qECv2wNP3lEMD0qnxy9PS1UjgwlVrMnfbTQbcvvo4jpjEkibUnG7hKrqF7DEsJJtonB6QoZ84c-CMDfec6a_UxwnIH7Dp0776V7wHdaB4WB08qaPKtHpaDFQy0JgvpKxDKSiyVAUME4wQWpRdBZiRTJffLBlxG9XJy4V7oNbVVXtWKYznfKy4oUjPFlrMbYj6VnNbYEDvrG9trV4H48jSpgqfJcFvleUR1JJPtUFW-8D7UO-RbCcoMaRZ510B8hSICKEH5gzxfx9hnTaUl6xwNBaI01Ebu5SqiBONdaMt1uqsYcjtaWN4gGTs3Rm1AomHkWlV70B1jf9j2ODi_na_NggMCN6-HD3HoqOAb9IK10NqPOniLddAXRb_qFiRnja8CZnzE0EdSG3lU-7_Vkf6mpIqJZt6HO7A_94W9a_hANa9SI-AXMzE4VwwA0l5KwJy7c8ETOKV8SLMB3I_1o8ih3ZXgNggkg1GJyaHI5jq3YDEmrKg53RTLzZQCsKr8zgRA-DhBGJGOhOz1E4cuSeP7uUbcD2SCitrkws-bZMoGND5AN5Mq195AKTOCLc-1zL4JjCyKL6FegcUu6ShXKfOJJnxMl2PlIvXw4g4izDBYOs8mM_2pBOsMSQ2CMBj9pnNSdE0AV3WBCsT-x3zyxM_Wcu7fMV9Db7M0c6fFKyoS2VLqcUHrKBHrw7zbLf_Bbfp2o-a7ev4NGRIQ&cid=CAQSTgAvHhf_k0pjWJr6E1_LmFNleDXbEJAuKtidhpndsofgLTL5WqZp23zIKIwgkWVBwmaojh2NswftJVRIEKZVl-VMqL9S62BFat8YXhZUzxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=17916798543473172000&adk=356101034&idt=95&cac=0&dtd=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.253.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-253-204.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 43c0112fe1dc30150732343ac9becb21ea18d14772f9c76a9c406736ea5efe4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame A5CF 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATspwKcGU3o60sTvomq8f55xKaoQjaCJ5C1v-GK1ApOvqmCQc-DJ7hXcXDExmqE4PuK0a9peSOOSqwoW7GBJJG6hQxg7EtZbdXAaeZ-xGZVKi6p0haNabdkHq2_jsRjBZQ4hGAcstQI8KfLlACuVKjqv_0YqvrKPQeA-mlB6KlPirfhZZuJUuOlccTewuabftnjqnMzxxhBsmzqLV2hdBy4Lvr4cK5biO_AwTwGm6BTMqCsP8&dbm_d=AKAmf-AlcZWgEMaSutTn0LAj4ArmLHnFqNH4aDyGuwhrSXrE32iBAzWg7-pCVB-XR1ZRJo7OfM9gUZumR4qw4DrfW97thJfQzNV5tzWfX9JPmcpLZ0s1LIq1DYl-f0EiBMta2_AFeO4Vpm9DPRGonu8rVlL4rxHZa5eVYMMBYgpdpQER2blCXPxXl57isd5ahsjJVIBReZKxHB9nKnzlWnue6P8poMLqYtYRc5BDeUk_bqmRd97KZoaG9YVvB25ptAgsEdTcufae3649U-6mRZFZt0Xi7FF1H7r8hAtuMDHzL1BTcrXWYapnxTFXILr1OqVunAwQmCLFB-ML_q36Dx7MM6TqS6BxDuCofqWwdsmBUr-RA07b5V_y8-dV-4NhkZ_zNkTRu7_xHucjANFzUTphXP-O8LSxYVuJdfviKHUkdQMStPeYKqPZndbAzRDgZlauniuy7Hc3b3qGoWYUBPqZ-XQyiSIr8dH-wi1BCyH1WeUFXd1CBRtYarsL6uezdjpXRqMhN7tMUGrEnE6QgHvefRCGyYhaDTjDBn0MOad0uB4p8J5T2n7OFIkHnaER6gNBIorBs5PPRUn2mbgj3AWXOTo3FJ37FkciN5rBRpTyNAjembj5X3ezwCoXnY6F_9ylI0pNU2fbK9V5QJ_MMVV6e9pbocNFlA69uqGKs_uVVJD_qGAKLsMnBJdILn-dedG84jnHMxA7aMTiA2GTGW5X93Lfr4Z3x0MGSPalBBSto23twyI2GQWP_6oY-1PnnULih7uE5IqLdIyXwCwCT_n7udi86nksGF2_XhAd9plzT-odSF3X86sqJJfXfgEfLENLqt3u1h7zkIVg4n4dKTox37xej3stmlwY2iyDl-Ry1h3xcaVtDncm1QeHZGLufWS_elHvAPt0Zb0fhGVGnMEq5D7A88Av_kaUydutQqlHTUponOeGegbcSR0ttOh89hPxTwwgFYy5FQ6CH2zmSaWXyIpr5b2pESIbhUfASTfkTI15dfeYQZonT8192Rz79hblRaIs11QZt0FH-SOkYq6IavqD4Rj745WcLHCUiRSM7Gd_NdiOygcTd0cmnh_5_t4uwbhMhzc5-IXzAj1sNbVPlN1Vekc-GOseYxML2-3h3pEN4-mmWqaBeryro_kpLHmVXvhZaoIlG6eBjUxF8d3jcZGpkSQDZC8ofrpBLy1tAMIpOS4HBKwckccV1xrBuM_3MTK1vLIcVDJj1nLkmH4PqrAfYmdRcbYgm65EMuZztPkYpR1nxA48IVNuCGiVWT8ovg3k1o9zSN_Ppqp-Q313QTBd8CH9cVsrtiuBJEJoU6-AGXbYoW9LZZyk5Q3ev2otPbZJL98zdT9w8dWqGzu7v1ouCLPH0V6xWQTjyf4vZqSqJmrCNht_Jjf93ZkKSM6O5VkCz9E9kDxMvPbTYngunatIb4SEvlnVbztTH_VdU0TiM0rdVBAYiRyMMPaZ_wEOTDxvpUF9VqhtjBK0Lhg-QQl4L9ZUhs4kMJ68Kcq_l4YLtZPyI4qk4Rq1iF_GjiR5ApOEVqNrBllX-IoY-hFysvQRVNR0fUWFbSpwRUakDiN2Dy-dPUJJOxa0ji7ix4rQi0lqhLon8MFK9QGmNM0IQCQ97FJMjPj-qK9Du_Qy0eDd3xP6omP74Fcouv05l8jndkEmv2YtIMaIjW_wO48OaeZ80QHVHIK3s0eQz5zhSOTMenDphAuo7p5vlCIiR0Wj0ja-_GmhKc73TMrP7GbqiPA15OUyQR36q6t6AM5Yf3bDuqAMUu9edsJPD1se2-1r8cke4r9ahhTBivo3x9Kf0yT3Shdls1UWhPxjG5XbZAxwFmalhdiRID6AvbHiH2HYiEWdju5zS9oRw-BwlEoxBxftuGn72phoa3YAGGGwWz1gaM2WAkEnj4YncthRZVZfcvATDfu1jdSNV_R6EhePJ0t8NUCb4idHNGGJB09iVQb0OyJUwfqXIcyLL0EG7cRMvnyn0trsUhHIhJXpucwjHzQisZKqxgK7XPliqxqBBqPHFmAM6r7ZIapGg50gDROolCLROay2QLMHBpiepDZxm7xVrbOxslJRZiPuTKyUvY9pufIpYmnIRwH9DEUHPzZsFj1ubEYBfJwwCcAH5ep6-3K7WIIJAFbMpBdUP_N1vtYKJYEIZkdoOazy1tyhCDoPEwmV7H9KEKuy7myL0LKOjUVcM6T66tKqMtoG6zTOxvxC9EAv78whYLR_kZxfQL_7mwGoMqttCuZfQTqI5vG7wJxTQkYwp5I5NOJwCf6LB6_UESGVocFjJs_2Wo0t1XLAfV218pGiw5xe7PBsgW0BdVcMt_XL7vN3A5WRDPdU3gQneaRrNHFkUhy2LT5SLCADL3JHOf2-_7bIOGrusM-C4AoCcd26g_OXkodBXlZa3tmsnHb2RSuEOvhUYyIshMbPjsHelb3n0RRfTnGWRddrxqyArvsDBHH6LR73RbFRSef_p6S6UfKeNMliOT0Mo_Ox1FCyw8Zxi92-zrpLuu90DGMqtqvI525srv2EbbqmzrXleb-oQ9Up9ba9NmJACCkNuIjrBXuTBnECAcOeKqhnG9SJpRjBMechTAkAMWM5jicSo2VphyhaGr2QR87DkrNou-NAvx6hrCYKxOPMydA8sopEPd57XHVogFmbdFKynD8AA1ZtabTcjY6PSy96rk_zbiOtAq97c_ZfhMufYRoJtGgk37M2F77aciAxX8hoPQN1qCtD_Ebbpy3f0tvHQXPDqpDSRzDbGXKlFEu-kya_d_uymnNpR0q-eyLiJu8Pzgzj_HCNOg5D984gMfOBbABPfG-WbRogvGH5oIVYEz-e0GYiKSGN9FpPBaLli3VCUxjBw0933N_WnyoIMxSt45UKM1PwujWSMpbfui6bpjV_tPYkWjOMl8JkRMLob-TbeeUYqdnfFrlu6DnK1dXLabpYwc41rm-OQQqpmI3StRNi6ngkB2Z0fzVypr8yI4aoegFQSyt--VPFpbWHV2E3_QS4iUpcoYeOjhxOnarhoJAVtc9zLfCop4y2XEcD4A6u5QqjVxhPNtz34OkUVha_Tt8AScBMHlmf72PD_iXK2Nqf1KwFXJGHOtTtNEat6yKn7p_rCPNfpScR70u1jabdHnh6slj8J0bpJZRMwpJ5sxv42zXLl7xeZBnF-U2YReROhMhmWSj5jaaC_14UBDeh11rebzsu-WUCfOhPM9CksEdSPpd5mS0n6SzAld8j247lxfGXISQoshpTEexx-JS36ZKBSTpj-WED-DvPPDgLg8Z8NID_5SKA58NN2498pGNM7xXFD7OrZvw3mmCFLD9DSShMub_X6_naM2ybTZa4qECv2wNP3lEMD0qnxy9PS1UjgwlVrMnfbTQbcvvo4jpjEkibUnG7hKrqF7DEsJJtonB6QoZ84c-CMDfec6a_UxwnIH7Dp0776V7wHdaB4WB08qaPKtHpaDFQy0JgvpKxDKSiyVAUME4wQWpRdBZiRTJffLBlxG9XJy4V7oNbVVXtWKYznfKy4oUjPFlrMbYj6VnNbYEDvrG9trV4H48jSpgqfJcFvleUR1JJPtUFW-8D7UO-RbCcoMaRZ510B8hSICKEH5gzxfx9hnTaUl6xwNBaI01Ebu5SqiBONdaMt1uqsYcjtaWN4gGTs3Rm1AomHkWlV70B1jf9j2ODi_na_NggMCN6-HD3HoqOAb9IK10NqPOniLddAXRb_qFiRnja8CZnzE0EdSG3lU-7_Vkf6mpIqJZt6HO7A_94W9a_hANa9SI-AXMzE4VwwA0l5KwJy7c8ETOKV8SLMB3I_1o8ih3ZXgNggkg1GJyaHI5jq3YDEmrKg53RTLzZQCsKr8zgRA-DhBGJGOhOz1E4cuSeP7uUbcD2SCitrkws-bZMoGND5AN5Mq195AKTOCLc-1zL4JjCyKL6FegcUu6ShXKfOJJnxMl2PlIvXw4g4izDBYOs8mM_2pBOsMSQ2CMBj9pnNSdE0AV3WBCsT-x3zyxM_Wcu7fMV9Db7M0c6fFKyoS2VLqcUHrKBHrw7zbLf_Bbfp2o-a7ev4NGRIQ&cid=CAQSTgAvHhf_k0pjWJr6E1_LmFNleDXbEJAuKtidhpndsofgLTL5WqZp23zIKIwgkWVBwmaojh2NswftJVRIEKZVl-VMqL9S62BFat8YXhZUzxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=17916798543473172000&adk=356101034&idt=95&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame A5CF 12 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9558
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:27 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A5CF 0
0 91ms
55ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuKQXvxtGgLVbdwu1DOq6jFW4-xjXBfVEOdOpCNvswYPYkU_9iiIiFwrEY3vzlSepDFsOah4_SC-WPzRdog6kQFcrcRHpcI_CjeWPD0ZhyF8KoBD4sbb3GIhEVVp5q0K2eapCJD-tC8POW32XTGQSwVu1g988AdlWX9y4LxMctQSAY4LBZNaSwkPFr0GosGXScQM1SlxlXKPZ_r01u_lHutkXUDHsGnU2YXzeEdcN7GAH1tGtLoYATdc3xP0BlMZyx8TyPa3cd_FuxOicl4J2T0kj6PM4_w-327OGtnWhmdl8LFSgSyARp-zSXccZ5ATvQnWVobUogwE2IQxvLkYR13lw1uNFKr0eSz5adayGh0m8oCFuMtHLLvYXF_RXzZ15EQ7kOONoEde9GfvbaD-q9JfHftPmKW01PIRoTrZthT6FbwQOeUfPKqvwkfiFDC9tOSelTaMzucgE0O9Xx7z3JZTxYMeUzJC735sQPy0_sn0gME9Fb4DD46f71EOXD44qAIGDk7z7THGUzsl-p0JcyN31DP4gjKz_iwxRO1wcLvd1OfscqUcH9RzrhNcd_mhm9-9B_j9GOD6Qu9hwyoNn7rlhEuQ0RhEyIC_Y60Ou4pCbZdugoNSu8oN-WsrMDwhNwZt4ViulSq-XOsr7L8GaMGdFIRS0bUgXFGG6x7dygp7m8ECUQbD7G55IObm3ZwH9VKFSAtm-ZearrCrSypJFKt2daDuRILaYkZcUfxwodVHu5JWYys1TxwbHWr2hB0fDcl1qyRjaiKoBhN_Pl277uikGMDq8roKz65_Dm1C4FH_sO3zulapwtHLwomPR2D0Mmuni4ARW5FQ8zafZ5RRUGUuSZgBzESC6cMnl1eNWj76mrf3jvqWqMtOe8JYRaBVjhHzbY01rQSqB--OJAZ9Q1rJz3ODDDvCviF9XkFHQ519g10TNl93oM5yIDxG_PZXqXFtRYD8Mnx5ZpCCOqeflLV4z1dOiD50JDEqRgEZonQEMuAJdhmuRH3SCkQpOnFFdi98BRBUOJ39iVFcb5SRkvLevvxONJYUTpOAqNViPjn0WDdD0HDEtkBVhNJtdVO7rAn0g7Mw-UGG_y1_2DiqY2J-xiITrxuOIf0IjJJ5XDklBcaBGJwsgQEbcfkyS-FypDZDxGjeqhFJc9Ygmo1uiQ8UgaanmBhkZ_yXIN2WarBaXGIk2mOR8Dn_GqmbQ5GPIzChxTMiBC7kgpv6YJPGK2Ds-3R-tncUthLdtg5DKp7DD2TuSeV0-i0H3ybRIG6Ix9f9CNfrg6iFyNOSbef_EZn8jEXXeNN3pvJD3XTMzpeypOPLJQiU2W9SqeGrPDu5Q1UdJo0uKJmwZ2MZo0AzspqX1NuN-BqqDmafYfXpvJ1r452OuWtZBsBza6JDKf8yleCydsGWJ0c_dl8hXw2sg9E5QDv5guw4vurV4Vdhmpnne3RL4TaOL_hmAtFiyc3wtuSqEmMNYA&sai=AMfl-YSGJnDHQU79yt0J0cPPprwwq8LJAHiG69j7ze2NPJcXk3eA1kSz-DZelg_iLbh_2APF0NtdxzhutJXGvSEyIKNn_DQUFhdSYUOcj83DKR-SZ2CsHuGmpo5-0j673L6CuPahGVjinxGUUDLaBuP6vFJy8WXz5GeQoFy6BAsAGbFshfeuI032GNKdjI-Rgu4L787IjcLXKXZwOtpmW5PEt73CPK2Kytku4LHNYZXcjuTz79i1AXDzLjDqY2NCENLxeBeq27mzwl4xKrwMBoqQdS70rS6rC6wy0TbXYGdA9pvkjgHV7CAR8UMDsdo3NxN6&sig=Cg0ArKJSzIap8flXDlDmEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240214.88329&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A5CF 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame A5CF 54 KB
54 KB 26ms
11ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 339663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
20 B 38ms
37ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1280319751432&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1280319751432&version=m202401290101&ct=77&x=1&cor=12259537849476438000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AAB1 35 KB
20 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CivBOzJwArUVQ63fzBzkeLaVXPPuzQBVhrU5csC9WCiWqAWdmKJ1BdGgVwSTIVzZS5VuWwc6CHY7x6odchhrIaEmY76IaYkeECI9BQxgrOpOdCCE1cg9iuaac-YkzeBImYAJe6r6wNGDO-MXcRJlLYMmPSY5mlFWA2YVsDO92P6TAKHdY&cry=1&dbm_d=AKAmf-D39pOsK6YkWxuVrKiHQwBiq9KXai3kO0VfPuvdf9Ugf_SivlW4PIaJx7HM6sreM64L7SO7B6SODHS78dH_a-fTIVS-GQgRo9nAfcrpoTBuywIm6nFFAU1fUMafcUDrZqbaeO2IM-nDtfyGkygKQaWFwsxN92OgPECHAvJIhTavHo7yP2MlQSO1mYPUoHn7kuFo3es-2nr1BVdLIsAD0-8odgHKrg6Eesd0W90kn3a2o4TeeHEXmuzpbK9rMsZE414guqE4yJeNYQMcwyT3HPZXr9MJNvHPaIDpg32RFFoP7PsU68IxXq8vpPAP1lk89FR7eE0tiLG-9azYsgX_se-9gKUFo3TEkpdRnre4NunqES_zR12TlDF0PbeEJn8g5BYpngurICdeizW2Rw3xQ6sRO-iolo1r887J4Bx-bM0fQQvULgpvwtYGX9AXoCFk6RSKHVO-ZYLsNGW56lw6NippqZ2zFEOo--adI6shRa2FmDryJW5JZ30c8m5PuFuJf9Qq3WjjIUoPxSkXPccQSxFElqO-MhUjLtCdLgQZxuOpYOgBVaWO2Vsf5nW05qsJlfvAOSyQFWxvFqKxFvoJhu9Uq4X_Do0CuPktSnoMApnGcHtnzWqUYT9J_VMdDVu-epF1jZ-XrU03ehtPEJ9X5SA5ALCM3mdLl1SOcs4Z0iVBHxSwPK4STAfnqrEZ5q7010YkV6ZHRE0wCy9oUZRv7LDosPEn24mQvWXuGRybmDDsjLOdbunwxWsLEDgXdGJAISxeAApwWpzNwPRwb2f0a5SfSfssUfEls2g2sbS7QJBc8k_hhcV8iJz7IedGZS6zaoriq4P7PEPwn1kCMR8OpPPddPv8KcAKo5jrq_obXqjjvwnnbWfxAWIPAQZ-4rRnViSsd9fqbnDlI5kc6Va_4JEXeAW0zRhtkF-5JGzQXUxqYW8ivVLU7uoJgtImv0zDvv0oPTLBe6mcypz8bK5UmpXcO63UG2EJbdUyuam6oV1OEQquyso7Et6EYoOJ3URBKur6O9E8BFJwh2pGWqyL7cQqBN1Ij9duo4it4jh_v4jCk6HTyseBaPYr33eQGt0GcoPKMxzAwpsLROstef6JLc7yZCu5rsjzUFLrjw9XLZqeZqbcpi2Z313vNwvnr54sz0JOcLF2BHZp3EJsOvTw2cCIxl82CPmpGuqHI1Kh1gwCsHnq0bnt8atGWJwQLKCzrpmAwhbhvEkmbSyTvaJ5fxQ55z2EwsI6afKeE3n0gzeVpAIElc7Spo-XTySZNDvtpfi8l3Luclf4r2E-bWsnQT6zI5ttJDnduHFdGcwqU84joyPXePgPMz1oIoVBtvrLuaUEWvvdTm_wAPSY9IqgSUcJB4UJLaEZFc79DXfPkUdqWa9ge6Lna3JU2c3RphmSNt4hBf_eQQh_eTKQd_bPPxtBujcJWsCya3T_pWr1AKvyI7UTPqg_goiKl7ycYV4CfUejGf9fqVqzCcdfNefsDzuHN2fu0dtxpi_O4NMyTi9oBbLwCiwGsUKlVOI2ZDL75VgUwyWcQ-6-F0xNj_LseSS3vkfjRXC7oWI6EF5cV-9O9P_h0v4NDmPtK7_1sEDz8NpqGvBhEgAyvIhZkylsRbxL9nAQblI8XqLbVTvTRNYzs7rxCD-uXQnrZ_tJlabYCfTgH6MHjrjUWgzhyU0m_p3wAl-2BiYRVsCWDvOcw9Glp8tSZS1_muD9grifYYySNGfdcQBfo0iZsP2y-7jyWXaP_baYnavQl9JmL1td9f3V9Myvr1sggg8hFCYDM6sebf7kLPylSE49IyFOC5gFAigZ4yrwtXEhaXfAO4hU4l9o-978ExPd1YsoRzPS_o0X2EkIy9EIt17P4ctnrWvfxZjuHZEkzpcqPhOaFHEYmb-Uz_F9ofW7-fLpK-Uxk5Sa03b1MZyPF-ndZye2OTDxaR3jmU_J3kRSLRXXr0_AXKwIlTjBmsGFFnyVYf10Oyr2ggpvqc1at-4MEldJVx101Hcs9SRiGNvew4WfZb-9yputvM8RCEnPd-WIp9cI0iYWy2TpXLfNBJRZBLsbbgAr-P2faM3oGHQt83JhhRiS3zVxKy9FpW31fy5TzcD_s_-tQTtusQzHF12jsSQXGoKVaWzdIPQNO0DIQ8KEXAMRUo9jArJHL_0MoU7aYmgbKB9wpL7-xSfswHsc9YVtKPzXXhJEGcFGu_tVkhGDy2yX6i6h69HCJtIKZMqmBeWKitA1J-BcQjWtgVWJscPwkiEIDJJmKPbPagtPKeFqRjkAJW7qnXaPtJgengMuo161r9poOokM2Z8kalkrWgLlAcL_-tlu3Qm3M0Gbuoeff5OmQvlpyeWZPYtw5qxK3gZ1VKYLDW7H_U_UdLvyKDAK9_8NFLzfJKKTJcCDEfYBzZ47Cb86vFSOrcF9VdRFTzwMH7qg1ntNcEVOdYU3hYtauWb4evx88qiWPFCA6RRda_aRR4fidEuVAMjwGLy-6_ysVgfsNx-q2fqmkwmPkmFM1bpMYINfUEJaqoVKBCigg9cZ9qNuk3uPHUBiPt2xxPWKDD76aOVhUzJnrHFY40aM__hjaDEq57MKbfOmbANWyVUTghP_K29AcbERsG76XmSbRP4XFROD-HHcM0bZOk0bFPaGdpv9sjfFfMVuSWT7Y_g5bkylkJd0Icw-5dvSgDXYJ1I1XLTPSs42UjHbTeMadpgT5qeevc8WkE0OC2EqMLGURmvYwHGHWs3ynsxBOAgSWOoqqw5O7iW2ENRXrlSJikIz6UQeOf-Ums-P2GVqV7IaBEOc8vkPyMO7qyojtrs0fNrEVoZ_saAMlAH8dTNxM9T0Mpm9_zI7DbjbaTjqTS6276oM91M0li7_k_NVOpy8yWdWHMUXDa_hi4Jlrky9FlQrgD2NgDQ6nw_GDSvGK2RUx3XsBRDieZVhUIurO5GP_IJbsbm_1mq1tnXQK8RvcCvIBOP9hqrIMEa_CUNiJDhtobCq9_57czrZA3o0vIw2sa_kaBo4TFIBl1mSgr5AXNnGrvvLeUZRMzXzV0ZP0STdjwBFVl-T6iLYnlE0rxhr5WcTWqDmvxQf_itywpR9IrZuP0ljBWjdztg12UtCBZhb02IAVQn9DE21Bpk9gcwRCM1E-vev4vZ8Rf0J0gxXmiD5PZnZ_YjvVg7cFnN67H_0sDmFbp0yn8012YCLuhuXeExSG2uvvVkOYebMcs9W_j5ChBKXXz1VtWK2AuYNoShaThNVk6yIG1-BhStIYg3mcDH4cYozeyn3VCrfnlmKmDB60aFJYRSk6-WzmJV1eg00KhtPlII52VEX5kPqahP5Lm-MHf4T8DOUHExBRcSOloV5dxQCL1WQkvDkuydCk7CWRE4fQwsJdsKQrlYtbPxaL8eLKg2OwWGhPvAb6czWk4bWiM-0WNgSlUdv5aJoPuGgOkK5W3RxXmsKy2hPKZtZ1Kf0_kjqACS2VmWRSEPipslhX3S_MEvGIkNCeiSdQUeX7a2ANlVV54MnlMKHA8lSaBMu5lhQ0pIiFN2kBGDkJiYDJqBmcfN6t-sy1keok1Ko1lKwt5OzTUQ81hHsm4kFeolmNBhLF7FYpu_2Z_iSIktgErzFkpviDbGu_CMC9lE2Ld8aEpRoKNaxSlt3pjXpw2L3z2wes9ZAnyPv-A2ub62YQ8yhp9F_JzatJf65Snc2mjB69lRnrYktXSJYf6APnkpFDqhptZE8C_wXmaNrpxrrejehXvYMow2y1GYrp6mSF3HYXRUmDceuxJxR5rSbMSRJpyrfy8jNnCylw9VdPUCKB5z39ISZD2rAXCpeJK2cpMGsshPIUG-yTlOoPQPdzp4sLmrZyFRibOX8SPLjdOZuwRPo1TNSM8DdeNYlznnvsGPHHn06xd33FgfyML1zHltJKEetTveu6XukMbxrsH_F0TgaYEFiXrMM_lN2fcN-kFprm5uR5LSefTe_jFnzZEBNSf7-oBgbB4Y80OTe7a17If3bNDiZTu5DFWmdd9z6HjPQTewVdfCoadlbxY3HMCyvATASvTabY47DR61VliHgwmrTvbhb2NCHfx5FfvrgOEyt-epPa_2v8O0b0RipYHmUHnjRzJgj08V2c8MgeOX4nvESw7Cb-sEoJCnq3fLHNpOnnzkBQvMqwmEHIHRlWFIzOEKJwivL7p9SjZbebxNV37XUO6xWsyANok5UAje7vwVdTzKdkb4&cid=CAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=12259537849476438000&adk=2857193499&idt=56&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

196d1b6b97ea644a280905d0e90f501d5669694699b5ce502ba5e8abdc178993

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20148
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AB32 0
16 B 46ms
46ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNXouvrywTA6MVWlK-NxsAVZxftL7IwTtA0OqMVCCKHPaMu50wJafxafLnj3M6k3tuq4DNkMXw8UE49ocKuxyU8Er8wWmk83_RbvTDY1TyOD5oWK9fRNW2vKFNcGdNkNqvvTZGSR3kK2u3uxtjJPg86fA1xosEMbjZ4iUDXTn-Dfmm2WVFA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B923 0
16 B 44ms
44ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNVjfqQKp2cLhrDuMJz4qH3EMaV1X7XcX9Wh2c3ZqntjwA4zJmu9mA8wHHtgk3uePN0ZxOOf4SC-x29EIaVvP8q5QQekSQEtiGK24HoFmJ0SOVDaeqfuV-7dZWI3si4eTqRwE7tSaWbnMSUU92TjnebTSXRSq1OFCPyTKzybzhIebhAwnWw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB4E 42 B
63 B 38ms
38ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AWJzyC1scoiBYA93HFhJp7bc1dS1MolLGHiYTV-xscdmhj4xcuICR3Nmy1y7URVxGqfUISftlXxrY7s_Cn8E_7ClwelFC9A4_cUy8jmoHWky2j4Qk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame BB4E 93 KB
33 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame BB4E 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame BB4E 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame BB4E 204 KB
61 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET

partner
sync.search.spotxchange.com/ Frame 97EB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEIyASPWtplPe5xzCusLpIls&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame 97EB 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 97EB 0
125 B 95ms
37ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUEwFyORpQmGJ69j5T5FiLY7__LfVYomPS8aQBVRVMGjd8hij1daLG4JFotdp4Ar7AtReo_bbg6QnVUJeMM22hdaEH1xbI2237XC52lAvXGgarATIoKnjQjwD802yeRhqXXQo4RO6XKRoEl2NjXnngBaFOYXGLk5ZVnpDXLbIBzPW5OR4Y

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

404

/
rtb-csync.smartadserver.com/redir/ Frame 5712
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEEPpPuHR1AF6-zVWuGWDINo&google_cver=1

9 B
90 B

325ms
13ms

Image
text/plain

81.17.55.172
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEEPpPuHR1AF6-zVWuGWDINo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXNsaQCENrtytQCGPHts4cCMAE&v=APEucNWGjFyasfJANT_PXZxXohGBGLi9jelcYuY_giSpoiXYmlFKjFIeJwo0WI3rCdTTentmpS9gCFyBJ0oJ3I9u7txfDLWoBZEMAu6wjXd1hGTYfYICGr15xja9EYQZmAxIIqWswO1M4_l3ILQF8qAib1ppyAuQmwpS8yYnLaMU0EknaCaO7OY
Protocol: H2
Server: 81.17.55.172 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-length: 9
content-type: text/plain; charset=utf-8

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEEPpPuHR1AF6-zVWuGWDINo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 /
rtb-csync.smartadserver.com/redir/ Frame 5712 9 B
89 B 344ms
14ms Image
text/plain 81.17.55.172
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXNsaQCENrtytQCGPHts4cCMAE&v=APEucNWGjFyasfJANT_PXZxXohGBGLi9jelcYuY_giSpoiXYmlFKjFIeJwo0WI3rCdTTentmpS9gCFyBJ0oJ3I9u7txfDLWoBZEMAu6wjXd1hGTYfYICGr15xja9EYQZmAxIIqWswO1M4_l3ILQF8qAib1ppyAuQmwpS8yYnLaMU0EknaCaO7OY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.17.55.172 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-length: 9
content-type: text/plain; charset=utf-8

GET
DATA 200
OK truncated
/ Frame A5CF 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dcab80660bea11b6a6d7d00b0c7663428be9775527d37f8c712084373e920808

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 3FA0 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVq6rbDD6ytgDA0GIVfVUvG21psqXQHqc18NgQnY_vjt7k3LXgKfaUvoS4lcpKWgW8K1QHlfVOUWePQLD0Xur7OitBC4MmvWaS_tLmoA7rmm0l8YESvEOuE22aQB7Pd-yEBYZM9zW5ERClOA0AGZDqnyp342j5Q8dsDojqKi_dNAUvYak&cry=1&dbm_d=AKAmf-AR4iQerqdXVAlDLulXA0SgJVDEmYzuWmzRJAcTwGjYnbzM9K6izDgkh8FXAJ0IB32tKJ9ftXgFvCjo8ph5YYRXfM6OUNLAQLZ1mzK-MHgGm-SwfGwxNrNBjgYmaTWj37SoOAeodQ-HlAMdVjVt_ELk0_Yb43adlbjyO1PDP19NbpajE7KQvT0xZdY8Uy1mZ3dYd11jdTm76jWTFJtF3e9qURIvszUoZ0doopMXEegDJ0mTDOfUKw6H0Gnfo6Ok0eH-Z2P2WWh90XamcWpMf2e4P1Xljqoba3Hy_SLviALyvToYGcC27PpM8ytfWaShHQ7PnJhhaKP3vItQp1ZKBpTNrQxgQdP_rp7hd0wdH3Ky5EcqZywm8-g6Lchwne2H5OZ1hj0XYiXNITNTVKqqC-numClKS7VWUiM7cXJnbE9zDk2wR6h43mTUWLtoRh3JlwuxrxhT_vN8S2PolQZvrqxDjVk0Mg8CY_NPp93CXO_TNWp1PhhdTTpb-8SWb5guNdsO5ylmwsHMKl-R14nGR8U1VsMmfDqM-PEDGbYQWhWh42426_dIKUWNiWeq2PF9W-9TDoPeWGlFMkTbDxQIfaO_RFiaV1S4TKQatIrO8dFf56YBx2EbQqqlGQm7mWx6cMMtFHTWxCwCSRneI1pUJyuxbS23O6_nsYbL07VjAUA4b7FIgJW5IBIbObSxnoy9mydTXBD4M1d1aWtF4dpO2nTZ3uycbmm-o71Tjn77cw4QBhiMtKJRvb_uT6H8aBPvR-jpTwjjopGXgLpJr44fayAi7UgUJJvnHVm3PiM6HZ4wyjYiNhLm8De_kqLOVk0M5wDDQ8aSlENwH5AUvat3djK4yQR8wX62hGxalKSMWJOtY2TOAtseo539G5UZspKFI0sA5cgAOkPwlchnJpAiSSSrc9WPVSXcJ0BqAt6g_ghqIiQHLFSubgqiZjgn5M-HSPmzHop3wCoD_ftmu-L1m9bOOkRwoqztIK6FutWyw7LHAKqoQ7GUpe6sDF072XXjLFGKcHskovrfME767X9ONE4qIM7nsto4egxgkRkKPxqUDoWhRXtdLo5DQkTmXnA8WadutbDc8u33JGHT2AppPnyys-FKS2DihW4i1BwKo5Qb5vEgV3_ElOzzAL8xzBlsaLyrjsTnNYkiiQi3cwLfBt9-ZTkgdmly_XKEsjelzU6a4OQNEpqXanE-jeNDXmGuD1cYrHwCF_KPm3a6uyrQujcrTd40XiFXmcjDgzL1sHPXfSD1u-4WJ-5LOlDvRFrsbcVIqIYwFpxlqXd9xxVvv4U9WWQbgnk48TdeFEvpAXDlkPn4oM6MhOvlbHQN8nohrj01qNalavWgXiHl8DLdJg22TcHOUU6HxFWN42NpT93qa9TVUPCzaZCRzI95EBPyF0aUoE6XBKS3JD81aNpai2O3gNHd_ZKOzUBCast8LQNPqd-zqSQrf_mxwExIWwx2xumH5gYBRmIC1fIyD-1LK2BG_C6WyUrKlPDVf1lFPZfOMhEcW5fBX8llxwAf_ReUdZMf_obYIhtcuUhARV6WJKRS3OFjoBHkpo32EJICEnkJQmteM8cwmhKdqi_nJ1pI2ctDwbHy20FJ56CP5h3UHbo_AC46S-H6EQfwothWvVp6fUVzaMpXNmJzoiHBSZkSf_8j32yRzpAXqe6ED7bKH_5LRtR277dwKuNUJ4U7wETGKGCg2kJM9FGOO5Fi6xY7FFoPCedKRDAr9ksCYhVoQYUrNSoV-pxoCkdf-7v85wmj_QPIEinQTznp_duOrWYJFKTeOJca4-YI5rHBkg2PC_8jBc6-3uriZOZMt5nBvM9cSb-1bEC6lQgkUjmBceM3YmZ2KMXf2bKuNPstAIxjX1FHBmiOTrOlWGdqlUBc7FUscTnRAK2hxb6IKQRul0jkzu4C2IyC80dsF8HfYaspLpLCyC8XN2MH1uUEqWvN5aWZ90MGPm4TylxVxj_y6k0UGr6UZ_jDyYWogOo17xy_tW46-ZUjGUxOu5Sdq3JP1aySssRHVqXp_GXeZLk0sWRy_iCGOAuz3_EOOsZs-0z4ZiZOCivFs2Y79yFygi2BgJak92SMYO2pI39QaTTGpxP9ICBT5qw37JZcZVRHQ4-2dN8IsBCAEbi4tuRuBBpLRw-J8ksE5c_3yHdLtxOz8djMqsejeQtYOPuTPkCTb_kY9ACxv-oOT2d2SUmNSHG6WEg370Fb3a6rFgOnuP-nH5F7VKhXhADULu69S6cc1-XNhSbmlYGIncxmfmdm4Z8FicRklnWlezmRDby5tL3-0dNjDe3kzCfG3Ni_UKBludU9ApDGLJ5ud4q9rsT0XID13ja5j01V0u4hh8elVV5JEjxp73i-Aq7JM8MG9gCtEy603TJEaC7miozAuToHUbc6ngb7JTw6h-Ik3Yg22xhzm9gEn4N-v6y2UiAmRAVfhYPQd3oJJx95f1I5fnZW6yosuGjuLS46_gTOyOlgVTsrreAiwzJyCyl-xZbtCXDzsYBrJanKX2ROVryqPYkDhyEW8G44zzrXUF0wAJJ5dH58DtMQgGJaZ1M-aK5KAyDtHashWXq8irUde6Mn_3BSYRtKBnqX81wnWjYy8w6IDt_WtKFq2ea7BJS3x0oXR2mcz_-ugHNULz4TdVSyh9HW0dOj9_ufZ1OPgkK-7ApEpLp0VGdCYvm4qW_EuR1NgpEwU-voF6oDf3WzSigyoi6axJc0XFb7wyM_fWDRimEIVdIPQvaa-ZafXHW5JNhSsTeNR5J2KloyPAT0kb49EEIi4-NBfSfn-74nsSKddnPYv3Ix3iAyNGJWbxYeRkARvmfIT3akdAeED5lr-fQ75Z4Vy6hRFKRY-mDPZLyXzb8nTembpb55an0VuWcu1E99adp7GBcSGk-0-r5xQno-R6R75TVu-oxztVgDuBRWH6MErLeH1Mb9SrHV_wUqj4luxEa0hvgvC0jAswB6YWQzMg_VfO6QTrn1WxCTTEB22UwOBefGjO51aPO5t0qzJMEl-RO62QUSosJpGDRYTaIwtvyTJJS9qkoz9BOxzsAX9tYCWWq9hgmEtR855COD7007Oq4LWG7pNKKEtRW3lHQDXcTP0xM5fEuJPoTg2Ck4ZgV2pbMqC2ZKS7b-qVyPf3NZuKSfBFoJkHgf1004UsgEUD6Xt9egvWJEsjbOEZPCghZv7YyDB4Wt4PnTEny6E4Hd4NjCgyO_oY2UsvYb1H91XAnKQqb-2weje_YGVLa8lqCHNdXRcISch4ICIMi7c9qixCA_rBp0WdMDu98CVi6kPPe02S_7FSyH8hCh040ks-Za9qqR-n2t4X4lvmgUCkTAuQA_6QO5VmlwDLusCa2hnAF6zvU7wSw17dzWGtpEhzZYuyRZ4Av7gvoneHzXvCl_XOdNHVeQIz6z1mA8R6WD8sjn5cMKKryCUVfkzRyTziHYUosAAmM9jVQOzuNyzimgB8-0UuvuXDVz0suhQnTuG8audoesE66pTKErjNNVv97JzqCt-BmjtRj-f2lEICCHBcaZwH2Lirn29Cyh7EaPXCZ4b5h4nRFJ-fcRXqmPiFwB8IyUW-j3umLUFaSVyQ8FCFFsWSlce-e9QZ6BhNTn_iQNs43VPPmZeNuxbF3WUei_9KpQELTq2UkgodIcdPSzCA6rT_IUni8WE6gOiiy4FOKxuEJ62KkzD5uT2VY6gDA2kXT0BFLKah0TcbQKP64JHHLCxPvSRrDR5Pgnrk2Yx58mvUAXY-GBU5JeJ7bDkKjL0T_6SVDb59qALnZn3IykfkTxgaeXKBDmlNaadAGHatfYGqUyigWPAQwR2R8_jp1kXQaGQZ7SNf7aow7T3U0B17_O3FC_bsGTrq5Tv2e0cxNnPi3ZeT9B5_2C_WxwJt9VY_zeRs5veGGoaNsU5A3wJmCFMFkKXwH4QNhi6AFtclf3Gh2rsSKPAVm3FVFUOVN-dZ1R8N5MxOLi0EL9l6Zi0xyVuhmqI_DEAfqxJm5UtivUhIZgqjqNGVxVIPLmFWnJAtPpUFqTcnYMF3tgTJ_Ze6g_oJELJOGDHzWTCRSPHfmghDarrTkVHFBeuzoWR6oevNeOV2kPgz19q3ax5Z42mau0IE1kWfGW6rW38m11TS8EyKvh4-OkKzxV0qVJRSQoDML-9UrqEMrqTwT2FyOynl0poby5d5DJ2itrXvxhL7E8siBKgOJ11FVJywXB7QzIkR4M2asYwiNFoWqO&cid=CAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=13104364476690911000&adk=3047537734&idt=101&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 3FA0 41 KB
14 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTM0Mjc3MQogIHNlcnZlcl9pcDogMTQ2NTIyNTUxCiAgcHJvY2Vzc19pZDogMzg3NTk4NzU0OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 3FA0 0
499 B 319ms
318ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTM0Mjc3MQogIHNlcnZlcl9pcDogMTQ2NTIyNTUxCiAgcHJvY2Vzc19pZDogMzg3NTk4NzU0OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAyMzUzMjIxNjc1NzEzNTkyODEzCmRlYnVnX2tleTogMTU5MDM1NDkyMTU4OTUyOTk1MDQKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"15903549215895299504","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"2353221675713592813"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/4091885870270390682/ Frame 4660 116 KB
22 KB 9ms
7ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/4091885870270390682/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7215b8cbf58bf5e9e7baaa56e7ba6dcdb963d07f5d8982e729b209f8085d5275

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 272323
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 22402
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 15:27:02 GMT
expires: Wed, 12 Feb 2025 15:27:02 GMT
last-modified: Wed, 27 Sep 2023 10:13:51 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame B32F 0
0 54ms
53ms Fetch
image/gif 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuN7a2Si9s1tpxcxpDrueaUOdcLS3LnPUUY9YXSDssHYqUSpFUAyFTL7er0kWKVB4uUwhuNv6UwK-BT_fyAgdRVzxy6hetN1GvTvI5eh_dnoYRmZbfBZ0ci3iANQXHzvcBtlm7-iPEIThCdqlSAmH3mBn4wAnm2al3mfiPj8FhVaCFFdnuLGDqSptB8Qfx3z8bTU6B1CdQqjEn_ZwgvajPkEt6RoXgC_HsK1-n1S_Z1H53Z_HC3UPzHE5RB3bbSmHovuCEPlh5GIbuXwWVymL8tDXSPEsP63VJAbVeGLkza0tIyh8bqaC3n0pSlPCp2N0MSyiGDxZJXW_sbbOF5sDg7MbJ3xxUUwdk10uc3mdt1S0EcLptcXQ2sZ7XwDaLuomSjLkuWMmD9qU8CMXU8RBVI3zElVJyUvMhCc0kgGJRkm5pJxtvvUGxaKoQZXFdUMBZfjhmheOXlWh7Q6htxS1U3Rmr52w79GfP60_44OlnOYupB2PNa_iI_uBymNUncQcEOk_ISabb56tmu5PnTc4QTGtkvkHpEJMntyfBhYShZkfkXTw-8BGt0Gb-03xl7-njUbbQjb0PcznvI3Z05B_uwWaW62paPz37j-R6ABckfQlfnnWbr-B4xNcSVxD1RJ3TWO05uYljc0guOZuuFpqJ1AXjr4U4AdYFyqxjxOUJIAOEVMuifJx5M3eQ573zODUE44O7yzg5wuptj64TKcmX221iQpa-WDpmdlAN06ce9T-DKX3kqDVZdzutSUVtbhxBKZjWdZHHdHXQ4Oz5LfST5o4rF-UKDroNUiW4lXmZ0fL9VhvSkm5zK_n8z4xKLIfluuCuO_U2ixfisLqStRjbXd9AS0ini4dgFcfbIy_lhYNNSfnVqabPqXpprCf1kwtas1E_IYJLwF0ZXFQ0DomRCu0JSOz2MnWq9labFOwebcSyT7h6kr7mRsvnGSXuPCCMHIbUI-XhXhpgNmsrx33SRLpXvdf9BSbCXMYQd0fHfoiFMXed2gL83hAgU-KNodrZaSKm9-r41fWyMXk7wTGD5HY8d3OAUi3LUxymYmZde6Rt4kwCOBjKgs_ADKxAcM-KVbgwvBoUjT0REBD3G--TOaFAtH8OBNrKvAwHHCxI_My6gGjUxakUBCU7LtUn5BGr5VSj2DM05N4gASwXRaPBRK4-Lned6ZYI2MyRDCdkWUaV4q9BJIFNQKN6gstFKE3QKQGQjPWa8SwrS1oArWRyjJVR2vUD8QNFL8V8lZTm5yUuyR3WPCEQP-Vdw7HUIoj7xqqStmhBQbPslEhjRPcbM8SmY_EVgNjcnlvIdNkhNTfpgaoNhVjoM9i3xOqTkS0aRyGxzevei_5W5krG2B12iS2t98Dsw51kMCjz_U4kT1k-4Op4e4iQgvhqB&sai=AMfl-YQ8ZysGIsdFodJhrWCaxOi2Q7lMqeOelmhYqIudMxIfR6PxXwbrntwYEIEN-zeNqSHvy8D-cEyubsfdofATrJA6hq0H29WQziuDOPzjcEZzkmrERHmah0BwUR8F0HltoPvF60RYIMrd3e55ebp2c9EO1zXhG1abMLY4tDh4q_PSJQcNN3D5OHYF-e4lAVimC5x7BBPXcIjzbhfKw8RUKyK-geio-V48hBtSYCA_xPXhnxM5DT09NWelQY95KdoGNoA7hRVYEYNA1B-zmJrV9tb9HoehUopxMXVqgGVQBRyzfppyluZEK2ULjTdbYFnj5sGDLTTc4gXGsQN8qXsfXrlm9oQGRz8lJH0qjkukCb6S3VGDNo0oBQWojQStumldoNEVRro7XJ_npohiIyQiz2u7QXXr-k7DEoPpvIs5t8hLBP1i20VagyekK_a0vS18hoSIBxFmBhzGYW30CRDqLGmorKRHmVdeqULLV69NxY71HhjDvtbZnXy1w7mDLae5YXq60XVlcPLf&sig=Cg0ArKJSzCKKj2Giovk4EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly90dWkuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=241&cbvp=1&cstd=239&cisv=r20240214.34644&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E020 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4599282962194&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E020 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4599282962194&version=m202401290101&ct=77&x=1&cor=14884105883518288000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E020 34 KB
19 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D70Hx4rcYs2D-dGCXbcQxNZ0PjYq02NkqI_StqKvNWS1hwLV4AGqe46gIYvx5BWiTm5s0HNXI7cmGCiTdQXcnSByVTGTSe62uHM-rB_GBJ9QzB1wu7g9Fj9vrejovgdAYcg3R-23HM6O13-gMCA-Dq9pMHixiZifVO-jM8ixl2JTplJQk&cry=1&dbm_d=AKAmf-BG41mMpGZ_DnJ9z9yjCnr6YC7r0aTzNoa-DqXZ_2Dw30gGN-O1OrV6o-BHjEfEawNGwnZrkHvcplBi2mKB_ibzd2ffnlIrBDOOB7d1TJPQE1wuL6gUCwgyCW4Z-j2uIk3L78oBoXfqiIi_icTEa4FhgY6OdQa704W99QW5nCfgvNCAC75I_QOArMlAP2ETKIxutt1nw7EmvyBeI8qwPUbzo5HDuTZAdoGTpBeuxxLZr6j1nFpLGwI3PehpCzymqn6b7yF2vIf0d6TL52VsIOifPsVAXSbqSB2mULZPv7e3TUKMcaJeOtLMiggxtxGdUCfmTswhXrwRLsHHBMe9Rdv45WrHJRfjQUEy9yYhZZAdS8igWLy6lDFygw_PA3q7bJv_NxDXf4IMtUJn12mXSsbuavt1vZWaPxm8k-xwfKcIpIs38AKzXuPwZbd-JBGRkONXn5fDqnBmfGbvv2nhMhlytIqirEpHbKBwwSRUmE4iTUaiJJRbmPWKnV6CUjU7cIV-htPdbt0Mdm_i21rzYmZfUwvFZbDiWxz3ao20M5GAb1Z5LXVf-2kX9celXsMLE9a0_vwBJS-MJasuqbdkBEL_4Ge7JrRT6F6WwNsiIWBVlonwyd8ezkiBRKxfjjA-FarvhjBXwghYiew62tBYQZM-umvr6PZZj9zXVKDIrxd0U8md0HbPfoQTxnkcYRTsalbe4iVWdILJxlfhWpIIJ359fbMCvuuZebdcKOHscT4XjKjpFg7fZDsOf0PcGxXCmB-N4-2uuxsUfllzRm144iMxDfhtHzPlszchMhJ8JXcVyLs5dVUkstyXYF4Y1gZbBMKm9-_HU8gOHJ78vPDdwuUbEE91nibuWBcYi43pgFlSXL9ttcXFnSr70tsb4hABWTNs7J-iYE_P7q6i2GnOxZDwocCOqMSMwmZkQ4BXymYZv7wWQfrcMXHtHEViJvJgTPPZDLsFv8kaJ4-5D7vBPqea5WC3_oF8NOpE_6ydb5yoF7Gf8_Pt0HS_i8DKPft2kpCoq9u3of2AKSNO1An8M_vjvYYC_N8BUUAjVHgCyT2TbTQN1f3sKJK_oGsCo5PbEgvQqBfHv9y-Prfmu5IfZza9VUd_SzNezAbR5JTszyzZUfU7t81tPeToyY3LVGY1BgTW-hbf0Ja02t_9zowC0HHJq4IT2iUXpMkGBKfOcQiiYFPK_-EMH1TxICpz-LHkVaBbzno0ivKTYUi-4lQxpVoxONPHvE8koKiBrcxFYY2p0_7jMcgJvHt8NvLfLoUWgVS9hbJVVDjXvxuCp-b7TObnfnDWZ3NGXz3ah-9fPI_CIoaNNRcyTlKCVhlgE_GjiUbwqGIjzSTW_2UUci1AeDlX3EiN9_JvhQ2reWEUMNTKh_aDQtJ1-9yJkoBvZyYQKy-K8YuxybqFqzXvBQXpAiPBEf7z6RMRzNaj_fsm9YbfbudLDDVVdt3-mRodZ656tCoK0K7AxUMg7lschYCsmjscR8G1-UB8KwAlc_sFdvQsYgHraPyhiI0a2Mc-0DYNO92mvDot8klzr2vByTpYSt27qx01i_7-HvS1j_F0KwXeuCZEIBhRbGyUQn436aBDC-DsGeMqXep-WFOap6THg4bA907oRhcWXQbb53ZCzZuz3W79jK3JgQO_q2_qJMDuTWviUpfyD3KeV1VPn0x4etKV8r6tJI8veHyS2ree-AU7WE60p_HVvCl5GNCgenjNt-_Trl0W5O1iPyPaHIFN0oyO-6_X9AgUfNJA4K_12GbS6ED-eqyWi1iw8HuwtlNq-jUwhXTTeSBfnLKQ6W_l7tgEXwFKGZhyt11Zx0KFcceTBJ2Uxuv-y0ypX174sLJ6bYme3P5hjeeoQ1Ikrzwa5MWZBZJZsk5kx4N1BWIzFuHrIdpSqSF0oHq6VWT03QnGHiJX_i7eqUePinvSiGvwPmS20bWGaLZn9aCuy9tcf5de4tusDC6awftAipfxay6rdd7BXgaWbk5h-7Rfoo44P8brYmStGKxttZfaAnTG4iHOw87-F21L3HDyG11pjH_iAIa3e0AFMdfPzU_VgsYnn5X-K4lNwCLyzWoT4pcV8d5V2P6bGC-ob4JFqr63ISS1mZRgSgbUD2s1gA-9agPFRA5JqINZpZS3TBxFSqCD4fsKm7biawkVh6ecEuyovI-3CyJJv4_86LX8kF2j9IJR3OyH5Fmim9fL0pSjFQnqNC__u3of3vsXxgdr7b3DaFhLrXTKD11_Uua0kyOIYVONpB3X8-X91d_3gr5XP0BkiT78t36-2l74SlBwo8BLn59QT189pzpH5MVueSAlhDmgPDe8g1e41KUFF-31XxrS3dru3rtbIEGcqZUOIcOJ-zEIdcPfwp6yJs9zrI7BBu52eWe1mxqSTo0EzhOiZIsGmKb6z_ghtGJNDqggFuNf1EsNF21tWqTu2cJZTozt8S7Hnd3c-cChPbxNEWzw_v0fxrhxFgp8WK46wY048s45JbLtp6aF9gLgAn5O85TTR2BPjFqTz9mkFe5HtGJd2_W2hoJ3ooq8o5TGlu4OS3ioQnpkRmxphnFbBeKEkX18ywmIfsi0Oujxx7u3Yc0aexcUhAcIW4ri3StgkEG6eEmwQgEZVnBuZNWq9r5ijsHEdLbK922EKiKbi9-we_CUn9MvDrLs3O6hpcM5R5YblwYcdsjWlwaW7IwmQnZIwxxXRRC7VmQYG-dnGN5QFR2YAZniMrq-Eu1mFfjmX7n2NgsWQHSf9P6imzMVjvlWcJ_RTZUSp49vuaTkVettGYCj_DbbZkGgv6R8iH2-xdvtt8o1sb1RQumEg3MengCmHFjTpm9_CBob_MtrMZzIvrg4GRbjPJ4CFmv7ei2itfZLQWUNXtBJ3114YswT6pTPvvgVAHG69m26YJXJBa0Fzob89e-wT96ryjxNtGY_oRI21MgH35dxW0TeJArGzOMfVplXCV-mPelJ8hRhyf7m0lpxL-HB-NISPYjDEYfNU6AjU6Eep4MHQyh4DYmPfDB-ArCB2rkoEwjKOXFcq7dHcDP63iBo1etgGGrQeR8xlGyolRuqSoWqQTYNlzwnVT1jQ5rdePK6GnOKF5WKOTewsxxOZNM-Gpl15JBxljyDmCOjCJr4WIl_m0e_3movk-Ar7HDf_UO2NUIjJ2y_YMKcWoQkhEnccWPJ7wXiNlXVaba_qvBdl22J_q6PegJyh2w_EtlrQ-sC5yTEeeqx9GfOz4BKM15qxk5tfFrTnDLBN4TP4oYXpRubYr3sXHDbadUjk55_H8K-Hi3idWnaXqgvOh1sHAn6t4F_yGXu9OynYf-V5CHQt5PVFQvTlqmg5VS3TXg4wQ_8DJFUKzKPMkGELmtTHyncOg9crYpW8l0AZJqZRQXibJBfTqZsK4hPZxPbM1n_BMBXAmj8zFo3RhReVjylxGvKeB-4P9aBekSdMdIt4bfFm6IwgQ3NAcm7PdRKHtAYG9VtCza-qePlWXD0ZOIw5jbbaJ85IUsWnRvcjPS4QiUZAbZ9jsGjxAfhY-o1HJEMVjxkSPBX4GT_3OqyH4CAloy9OOkpCVVzy4Bz3iiyc1ENAvGS2me7sSwrATuegfQjvuKTQQyuulUmn9E5P-Y53BWdtjoQDWn5rKV1qugS21a-U4Fit-GiXb9noAV7EkkSZaR253i-jxi3rPzoJ4F0Joi_AX3IQk0z5WHXR-OV1Uk7qE0Zqh31NtJ8G6HrypxAQ835dD8IRo3gXVao6O4A7W4EhR84rilD_qHxttbQ3fFzPonf1Nlwx3b25aySqhgRGA3d9U9dmDFdH7chsOVjACICcSC_t4rNBnmAklIZmrPC-V3oIv1cGckBJ-ArqhUz73zGA5xGOQhIbwsiClv1Gue1Te328scMjwIT9I3aDWtY4XdLBmXtAkPUwhOokUs4NK75DygLgl81gv6Kis2-inpIeIffUEhvNw5aFzl2rPy2XxGjKlqYC_vdnucCE-kqXY7WyHwPyycOpwjDUP75ccodrgfHS9wVdmQ3KAa5DYUlBWZ8kJNKio52JrZEFeE8yxUu77VcIXtWbStG-qod4RiSSIfC_spH_dc3BIBuvUvmhZZ-d5r57cNKPFNIucZ9DSQElPYpRbX9dkv3EWjue-auclEmbJyv4LruFndDH4rHmLcySyR8b76jOq9c0hirGOHaCzkwFmDgMYpf3NZGACfkdwjNgZ0ThfI&cid=CAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=14884105883518288000&adk=943508964&idt=85&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aca7c5c9c12342cc30f79b4ec32c082ffa2aaf33bca12cd17838f1e84b5cea6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19838
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 07D0 0
16 B 52ms
51ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNW_Hs5HTcHchw3ngOR-m0e4S4-CBrkYtSjARBnNCg_ylz5FpSAbJmCnB0mEgKYaEl-Ai70PbJjkQB7A8o2-vPHufO9alV9Ys2FPt4jIxcDbhznaFRt8laAchM58gPzc8mVVfqCqpFB6TAn489Rfnzo9qqsoMiy4K8YmjhuYr5UOW6U37II

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A5CF 0
0 46ms
46ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuKQXvxtGgLVbdwu1DOq6jFW4-xjXBfVEOdOpCNvswYPYkU_9iiIiFwrEY3vzlSepDFsOah4_SC-WPzRdog6kQFcrcRHpcI_CjeWPD0ZhyF8KoBD4sbb3GIhEVVp5q0K2eapCJD-tC8POW32XTGQSwVu1g988AdlWX9y4LxMctQSAY4LBZNaSwkPFr0GosGXScQM1SlxlXKPZ_r01u_lHutkXUDHsGnU2YXzeEdcN7GAH1tGtLoYATdc3xP0BlMZyx8TyPa3cd_FuxOicl4J2T0kj6PM4_w-327OGtnWhmdl8LFSgSyARp-zSXccZ5ATvQnWVobUogwE2IQxvLkYR13lw1uNFKr0eSz5adayGh0m8oCFuMtHLLvYXF_RXzZ15EQ7kOONoEde9GfvbaD-q9JfHftPmKW01PIRoTrZthT6FbwQOeUfPKqvwkfiFDC9tOSelTaMzucgE0O9Xx7z3JZTxYMeUzJC735sQPy0_sn0gME9Fb4DD46f71EOXD44qAIGDk7z7THGUzsl-p0JcyN31DP4gjKz_iwxRO1wcLvd1OfscqUcH9RzrhNcd_mhm9-9B_j9GOD6Qu9hwyoNn7rlhEuQ0RhEyIC_Y60Ou4pCbZdugoNSu8oN-WsrMDwhNwZt4ViulSq-XOsr7L8GaMGdFIRS0bUgXFGG6x7dygp7m8ECUQbD7G55IObm3ZwH9VKFSAtm-ZearrCrSypJFKt2daDuRILaYkZcUfxwodVHu5JWYys1TxwbHWr2hB0fDcl1qyRjaiKoBhN_Pl277uikGMDq8roKz65_Dm1C4FH_sO3zulapwtHLwomPR2D0Mmuni4ARW5FQ8zafZ5RRUGUuSZgBzESC6cMnl1eNWj76mrf3jvqWqMtOe8JYRaBVjhHzbY01rQSqB--OJAZ9Q1rJz3ODDDvCviF9XkFHQ519g10TNl93oM5yIDxG_PZXqXFtRYD8Mnx5ZpCCOqeflLV4z1dOiD50JDEqRgEZonQEMuAJdhmuRH3SCkQpOnFFdi98BRBUOJ39iVFcb5SRkvLevvxONJYUTpOAqNViPjn0WDdD0HDEtkBVhNJtdVO7rAn0g7Mw-UGG_y1_2DiqY2J-xiITrxuOIf0IjJJ5XDklBcaBGJwsgQEbcfkyS-FypDZDxGjeqhFJc9Ygmo1uiQ8UgaanmBhkZ_yXIN2WarBaXGIk2mOR8Dn_GqmbQ5GPIzChxTMiBC7kgpv6YJPGK2Ds-3R-tncUthLdtg5DKp7DD2TuSeV0-i0H3ybRIG6Ix9f9CNfrg6iFyNOSbef_EZn8jEXXeNN3pvJD3XTMzpeypOPLJQiU2W9SqeGrPDu5Q1UdJo0uKJmwZ2MZo0AzspqX1NuN-BqqDmafYfXpvJ1r452OuWtZBsBza6JDKf8yleCydsGWJ0c_dl8hXw2sg9E5QDv5guw4vurV4Vdhmpnne3RL4TaOL_hmAtFiyc3wtuSqEmMNYA&sai=AMfl-YSGJnDHQU79yt0J0cPPprwwq8LJAHiG69j7ze2NPJcXk3eA1kSz-DZelg_iLbh_2APF0NtdxzhutJXGvSEyIKNn_DQUFhdSYUOcj83DKR-SZ2CsHuGmpo5-0j673L6CuPahGVjinxGUUDLaBuP6vFJy8WXz5GeQoFy6BAsAGbFshfeuI032GNKdjI-Rgu4L787IjcLXKXZwOtpmW5PEt73CPK2Kytku4LHNYZXcjuTz79i1AXDzLjDqY2NCENLxeBeq27mzwl4xKrwMBoqQdS70rS6rC6wy0TbXYGdA9pvkjgHV7CAR8UMDsdo3NxN6&sig=Cg0ArKJSzIap8flXDlDmEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=85&vt=11&dtpt=84&dett=2&cstd=0&cisv=r20240214.88329&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 63CC 30 KB
11 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ALDt_tQuoqB3fMBx3F-lGsjCuEoiTVkI9sut9gBFneptR2sALayC8NeKTQHzVvo0KNE0dfP-pJf9zvuA3yhqsvCJf8cjE5uH4rbkgv6VrFJebh-0DuAdn63Gyx3kMDdR_9uocgYaGMngmetwgK3EQrNZNlJJvoCpdlP3K4ECxaSCrQB8U&cry=1&dbm_d=AKAmf-CaoIYUEpSEVvqHoolC7DBZXK-sFDM8AsocsapjzWWJo-zCLx6Jjj20JIzoQSTE3LYTl1dJ89-_EDA5kBIyUSVYUMYcWn2f1VMhWvuRKAGuiId0igvtzmPi-wrixUewib3LWQEqJ0dZeIvki5vgesPAl07XMJ5YlumwVadmC41tQH2KWfGeaKBHRXQHa4_UmU1FfrYvXoD0UhZKiLHA2aA1xZi4Fe_NbEDEi0wvTjW__yIjh2UsXgZXSeY5GE3cogJVORXa5i1MqUqg-dmlsS4AwW9j6DSPuRQYFv2rZxMNULXsQKWQ_6wETWPc1NsJrOAqg7QdHOfnHklKni9qNW_TabE8CJQ7qg_L6Cqfdd7c_K3ejTGqEcw0_1X5Jy7YAMKMZZEHbq3dmnW9eCAspfOE6idNeVXfOKD-KGflrVBuoghkpAhJ_LGvaQCKUJh0pc2-kkwlQ6l4fsnJJwVy-c_bMsdxHSPEgA3X8pG0LBVM9agyN0Z3bnWEFZAIPiJsErTLOC-ypfK2T-JKAgwYq3r2MPqTFIchXkxoRCiJiJhlJrT7cyZiA3Y1AAD1LElTTLyaikx2sEuyrbOnOY4z8mpcDg3APHPG-EU68wYUiOVIOySBeG9OycmmwHDj52DR8werTkbmPEz5Nig1-K4s9jLxpBmmV6ySt-wriJSHwI-mFyxgKRHUiuLhkCmeVXdZWDo8LVP0nAP9XEtM_uje0lcWJVfGodqYeCxIuALrjvpZV5eUPmt-7IvMMIdfLEdA5mh0zX6Xqm4NBqWywHszhbJcHgez9cdWqvizI57a7GtASzlCthVzH0UDHJAgdKJ9EXtxGSgClbGYz21J-GbJ18OhX8WWwb7-sw8mKLZ6coglyubdw4monx0BR-3nNdGZXdb9u7-OARf-zYw0Bh398d3XJVhzWOEVUum-Ubqn2HKZCiQQQDVHUxQX16kT67lKDTQpf4dUC9JLXYSqg4_7CUYGkmRDe_IMau0yTy5fJgwwGoF1BtzHkwF6dxFNLI5NfbQbXJBbDzh3ztytax4AE1fk2q_WG2wBtk6P9ZdRuLOOfvQUDjnp_9Lx6YFBXk50WKgg_Gw8L1Y9KASGLF-6ekaPHFBEpJ0WJq3trmhqciUPwtyv2dH6zsuoAvXbaGINHnxlQTjhnDVk5VhdeJBIheA1GpG6ixZENUYSbJU3ddlw_OoLFrVhoRxbNXvfjrqz8F5jmr-1jNXwvFitCxkdezLvTr_3zNKgmXPVWinfhfiHDEM6XptDPsFZSXDu_xt8a427RkpQsrVl25gD6DqsR7wBW44yDHjymfkg8kEyyqbZGG35SLvgMZUfN9PNq160MxNk-oa5Sa4jdQavogtxwdje4hVgEPsrsbBsV3Ez3iQpf1Iyd-zhUcHNCGKuOdU3lanvZaQ3XBhH_4HzN6mfqHbyaxSUCYkAlQ7E3azWmb6sa5_dncdp6aLk3KuYbdAdH50pTk2JaUbIGLZBAU44wxyQ9dHidcN91D_LgaoV7LHcoTLUQZi_BKxH4v6K1lghP0DguvVl6juETQ-YZ4KAcvddC9NT5_Yb_kNpQHf7tuN9xA80rFynyC9VK4jT684AOBkCc9Vv3v7BR0nXs_PEQiTH0loKR4eVkJsGWaRGj8DhlZ9EVAB-l4VsawuIzUS0YPWuEby3o0myudLY6EVAfmiENA-pTrxBIciXgzqZ9tZOljvTrXnuONF7-9vDHJHldc4K5RK1R5XFML1f-Z2NUpoLz2_YfnH21SOWhnJ0hHnJdITr--VgT71C1O9Hed9g8ShnIJSK5IU93Ji34esdTpWpSMj-wmBubnLCLFm6Hcbjb1YyyO8WvRurFFEz3LmPvV5UWshuNPSQA4Am1GEk493Ca3fo71ggdZdvmkOLW3Uv_MH_doq1-3og18fXmppvd1TK0-5UMBbMQyWUwMDdljRXOLZsaLiScsGd-FmssI7Ria804rXBDGSLQVcrIEZQc1GfT2URv0AA0014c7AjCHdYmdanJAqob-un3PxFyG3SEtEsfheDlaV7lvPB01g1_Gat3rco-aZyprKH8isMIhsdligjr-xytqObd5-qMj7Rz2WaqIDa9khSXFQDqZ6sK35ZRJhUMnypTHsMHbNQOH7hmdMn0UsydXzEnSYYWumF2hd3nbdQSwoKPPMqirDBoAvQd2dF2E-5lLOPWpSne_Y9QRuF5R3XUlITsPxU6vriI97yMRaFCaRHkBmvGRB-9HwcQcSOKLkXBWjdz2cs7VdN5evqD6nNOZL6upKsGAM4qLHSuDYY-LgKdYfKad921bLPT5paOP4I6Jyuz5z5u7mJHzv2HatlwnqMMJmW4I9NvTvf427etTA3S-u2RwDCuaGDq8AIdE9W4LFeBdaH6gLM_HC_OxdTj1S_44mmUm-9debQdDPPUe23BZNHO9Wq1iEYcSpFg9zORs5FEyztadr5zNVPTiW0VA9bScuFtSIHHNSCKFb4bin1B2VwsobBUv1mCSi8PzNfV5F5I0Z0Y8aXQ5aB1NhUHb7u8NrfSsTzDhn9jtpn2SnvBcNN2WfhiZIQ2JqBTfDHwttPxyvi8IbKgEEV6kzhsSxLlK3qj2RCtG-4hwhA0wl1S4-liUZWh_IKAiEONqGLrdpE6JnUli-PZ1XxmsrEjvJAPLwV9VNOezh44cyPzyix1s5Jn8oGIgYjO70R7xoooXCZWkW5z3X4jlzP9z8umnMi47zzmewDFFZ97sWP1SQoAoQtL0GVTxkawrd5ICRYICKMTTuzvW9bcq6MFGZvAlTIy4i4llNtKUDflq9KrnXTiLrpUDjdGDuayzpePFTUFi3vGicyRcreaLtjcEvB48FtuCF3YO4hAgKaokxiMWqY5RsKeuTUf5KGagz0NrK4bNyL_QeLCJnd2iiPP7faJ8kPaCEnjImGSiOoVexVd0beDKYc2XD6Sc1NseSb-SQC7RgQDmWNKWBBbjSASyiRsoVAtAD6_CwWldfSVTazinAHQA-qYHE93Cup4VVHuuwttTuuA4qysXzqBhgxdoeXMgFd0vSGiPHUAnH5MUecfum_4oZ_22kd_beho7arHuoRnl023NcOoRjC3TFCQT09ePMx_QbzGehELJsH8Aux32bDP6X1gvYTQ0nNqNqrFUILg_1zo_-KM-eowqwzI6XwajN7BNReU7NzXOARwaMpVfUNhRieRBdRqmkWKqprMowRUK-t3s4xt3gM3WuVHoo5jEQb75U0n8Geiyl-F_tCaezw4Wem_RMr078o2SWjP0C-4iUZEmVO_dmC5CCXrRSkpepBmaYCe39HY_c3KpRcPTm36cEOaN31pmnroBREBjNviaaF3MCrgSaPVbNARYfoSuyee89D3ueuT3DxHf5CfkRiVHQPMzGxBI2yC22E_1rc1_bcSgyBZvofCkrDzUQuTP_ozfYzfZ7ADEE_nA7K4wnZVWksRcz28cY7_28674xLFEvu2NQtDcN19oj4ZVAoLJKE-entySzSMB6UAqMhGFRHWuQtHvQYVuw6wfMDJAvhaQGtNOXuBuYhJXop0XWj7zgN0fi9C0BOcsx64lasFNhJmvVoE1rs0GkXpKZnz6Y2aWnm6q_F4js2iNjtaOomV8Lk79uSGXPNyFzB9qDqbsTfSUOzsTMPen5UL_OtFr8o8_gS6G5wxNQ6xsOZXjAMY_lPjMtsrTcs3tjq95b2u2WGL95_JMpRPpU59wVnDZAGeMe7Po_6OVVvM8tf9w3Zsn1a5xeRPiWGjo6iQoVC8RAGD-DxnNYQ9Dy0O3VY88WGZIT_IeiNyGtJDmVg5AgnpiuaicW_Vo93YPmzSF8j73bh7_jHXz0lVuG3z4YcsjlUqFEp9XZhoHTHylS0LwmaDziZ_mKxY-9NqI0MZQ02PIVBDoXqQvJ0WckpxhP8dvxjyTFO_SAM6FK819z-IgvwOeMIE3DKMBEq0W1tpGCv6ovIAZG2FYUXucV6wogW3T0Jrkam34TTrQtXFkYbV9b95xM0ZDFOaWAFAx6Bz8PD--cZcnYe2b06amuQwNZFlCAEpG9wAnEJYKGgVo9wHAvsbSBOU3vRHv5bZgSB3UaPkdrIe4zSH09FD_y6nh-1oo9JthJaax5v6vLgJUqqcrUs6JF4mzT6ekFbohzNfsEjz-yjVucHKRK3LGLIKeu4MdSalZj6iY9pkdEKrpT_7uaZZPNy6BA0yKffGoyO9KI&cid=CAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=6316467786581408000&adk=2086295848&idt=54&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 63CC 41 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTM4Njk1MwogIHNlcnZlcl9pcDogMTM0MDU4MDE1CiAgcHJvY2Vzc19pZDogMTgyOTA0NTIyMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 63CC 0
22 B 45ms
44ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTM4Njk1MwogIHNlcnZlcl9pcDogMTM0MDU4MDE1CiAgcHJvY2Vzc19pZDogMTgyOTA0NTIyMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMzkwMDM1NDU2NzQ0NTk3MzIwMwpkZWJ1Z19rZXk6IDMxMzQzMDAzNzQ0MjQ1MjE2CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNC0wMi0xNiIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc1ODk5CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDcwNjcKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMi5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQKZG1hX3Byb2R1Y3RfaWQ6IDEyMjcxNTgzNwo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"31343003744245216","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"13900354567445973203"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame 6BF4 59 KB
14 KB 341ms
34ms Script
application/javascript 54.171.253.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Af7L9KhW6HaYFnYldQU_ogcE9gShCPa6shsjo6XF5K3Pq8YfNbe_nmWSY84dKrV4jvlmJUBb1jXni8iIqGKP2KYYHbCPNo6WPmqX0Q4WFRSIYcVbpoK-xUL4or36TvEdOesQzcemJxpJYnr31Ll1cLjeMetpFt1AMixUR4RQl1Hl7VILuAuXcEUuFkxtSKlObEaQ8D3R1r_D8xWFuPDBXCSUYIGb7YNUY4lugmW2a9b-wkbxQ&dbm_d=AKAmf-A0m0gvty-NAmpo46OFojYX6cVIThmT0YXNVfu5U_UUT440BurmH0iz8fFV4xBhiZYAvDe67FbCokSUNJBc4VeDdCWQlEEKcRKUDwkWTLZUUvpg-1Sqcy9aiFKR4gDHo_W3bx8tQxxHVPtuta2EXskPKUh9eXlLhI8oWIbZ12Ax3eZ4Z7FdNBU9Uzqlv0lVNkyxo3bICxHHNdGFsPmrdFsO6Zbl98GJBBD6-l7jsBcn2yDMxmV10lLGgHj8AvQP8u-Cfqcj2Avj1CwdotcByROPHge8QmDJCHQ3-6hQMIMbybHLUiLaRpBTvqVneu_24x7gNlM0uhUzOx-Pt4iTg6EgEmdl7mVlGg0_vfaQ5NMEeF38cwmazdiliJXa5YQ07ZgpZx-OPiPRMCiNt_HpBB8q7Wz_kD-uN1IEbd16bTVk7RK2i6cKDhEmLMKfJPXAq1fBsgnach2kxxCSmpnq_7fVhSxscBpJMiD_lhOCB2-3bSWMlE71JgsYm3ZxcM2dSSHfSpYHu2phdzaxOkAlxfdshWNgtAFIz1ykaFVnhxq9PI1Wdo8BGX5YGJIrQD5BJOB4V1wXuvDsI_XAo-tK690Gf-HycPiD1Sv-HaVt48OS2nfuB-Gic1dJVfj2ACxmXNtfOb13VR_7Ox174WDNFlJibbmA0d8jLZvBVJd0nl1eexX_wBreXS1BJcNE9-j5RtC-m0iPTboEKhMsqZfolBdrO71V3fpUdvRKCyxFHDXPWckrqmOb7bdOdDdWlKS3I9PAD1f1kYuxjkYk-kQ2tmoAyXfZ5J6Pm2INJo9zSE7QaSXUmaol7eWI7kDo1pUPXfa9oj3mmrdhHAigsluiQEBTtGmRnA6SE3gSssJXX089o3RiUsX_ya7WMDh5yo9p5b7iDqdGOB6ajJgIvNBoNv2bFHIjRYK9hus4s9U4Db3s6F7ci0UO9V2mnSNIDGirhEsZlFjHg-gKTNg9bLBxeBr0j7KOVk-PGNuAjgKMD4_UcNE56Fau0Q82VDumH0prmEyHc7DOFI6bCnwjKwgZJ-aWE_JbGs9ENXOsZ08l8skW3IX9Mic1Bf1S6F6n8XI1d59i4KZ-3TGp92OIXtxbCX0XGv4DA5XeuchxAXxsmifZTMc6Ybcy5b4_ntgL_AWWKx58XUwF3b4IvnsvKPzCM1T4fgUEK41VkfkqeLK5K015XH0qWboNLn6bdRLXpY5baPTjVf_KsqHZipqgscuzYjHA7-Vkl7voYKt-bb87tsqVBpHInyeEG6LDD3BRQAVSUvSKa3qHx2nC6jd5znlJnA2pUkMFJvV8dg1DO9_TCI9-98TSXD5qFQ_awJYcZEZkdiD6KsspJ2gAVaxgVIp8wqWRasE7PNtgTJrgJF-c0sQVFg2PW73EH7HIWauAQDs3nrKjyxQ401U8mtz9d2wSptQvYA0y7me78F7qr8R7U6f8SSk_3CH2YYZWiL8NKA0SsLutLNsjIMF7OpRy6ACACHQ8VE_4ck5HXEqmTS3vjGrEay_1tkw6Fqggk7pMBM2CZRbGN2aJdDm671d33O80qZisAGpVg9CJw8O-W1nYXUfxzxqGyZaXpp4uThWpwRrPH6C2p_xSg9E0PGtGJMC2wuDRLGQvl3x-NSxa8hDkcVB8kNb8LRW28B_Hctw2hYg6l0P1fFe4T-veYJFkayGP6zVGyIZpahS1oMG5e4DisnQ97PbteyR0HLRIYhn83qAaTu8z1jd-xqH1umjOw3zxtw-BGVd0RDq9ichzPcVqlb6jKFgReWX0KVGj1JX6Rg2YB-9sdk5boVGzsx4VvONc4mzgwQaBHpc7FTiV4ynUvSSHCT4Y6SqjzplS1yV0Y5BcnDASvpxU4Hn1CJwkRRhqowcr8X9sRB0EmeHv4eQO6vY_6TH8nBoQ1A1Nh3Ov0WuQJ1fXtzVNmd3N6TKpGhGGmcTqMZkNSQC8oDCbbbSOiatZdMnvY35ozMrLx1-PlWW5-M50hGb8R3xofDVWdCXAo4UTF-iG9fZZx33D_HMXOwyJpOAmzrv2hI4Ig31kAoi3pvjakIcaUnCj1k3JWauCfHousdTCvOt_WTYbuoe9rWSrj6TwCL6ZCG9I6ilqO7oGDtdrqEoZaZ-2bZhek8ZHODyIbjYizopwmoZXZVlRY_3oZVbVubpyLQqA3aexAHgm_LKSVB97GE2jrSt8t_kV5XYMtRueF9u65hp-GN34e5vle_2mJbbBDb_bkkiBOD7KpB5hOfVamSIXIEALtN9oA3E5D6bvH4CffG9jGXnOEqU2o-ixRXkSxIKnN9QZ9RuT9chnbwf3DErrJRxpMnYyHILYTMNWF1L61thj2sX5FDN95Om-G0glcPYngTObzjg6OSVdUxRvAUyWew8KphQzHlDE9LVKTaUSMJfuBWTcuEVVD-FOCtNNsTzNrqYDO8z3Uv6G_V0nE4KFyxa7lu-dZr5LqSzv1yJzKY2Wd-FOSH9OCKQyjye3a7Wm_CzAuAULBFmBNLhudosj0J5Ja_eZwO42SQzvXO0QeJhJYM4GNS0_PsdiclicZ7sdVO0rh5oeNWQjcUrAY3PR4MmBRklnafSkk-lIY5Jjr9y2dspDYDIhlvPUviolkIugTEayTZkLRcOaiWzPP8xA_JVMAta8iHLUtKpskynP98bdkApXj2npzKcf-yf5zMcrmdoJGCLAOEvaRunOg8z493xg0khkIufYVwUTq3e_phrvMjz-9YDxaMc1YcoD8pnzLviq40WiD45SLQByDWaHyl_xI4D5IAAcP4haLJBRjbuQf3EEbsTw1Y92mEm-uHx3F1zwc5Kydx41prC44WGjklMbR9ZBJtrHwEOH4XybpYlXx9Z_MlKVMLKSf2wJQOn3rtiEyB2km1-rZIXnpfESN0bHpmcgU0TYuNrtoWsaMVII8gAkVAR5W90Ls2IZyx-Gg4AZsFJOab6MgGhy80JArilM1pMlvJooT-EPb_S9hw4ct9BbO1EqQ8_4g6fwM88e2pQ_H7OvkEInB7ENp6S8m-3feFZebXcwte6oPHZ6nyN-ChgHVfFqXRaFvmNf_0pyBCpimI3_NKWTpVrt78fLGeb3i6FxU6sS9S7_X5GC2vuaFyLqcJUSxjRgFZ8cv_mmkMmnM_IXC36a4cxv16CBUJ9EmJmelSL2qlKsUoqu2mHfTuRpjB2fLEAjcuq4fv3uc_4aCQxspb_r_phIsAVSVtwiwEPNwQV9JD7C_ABs_AE43pEJ6yRtUgF-YUlRdHkju1hCo14LFZuHLxlQ8RAEE_quaoygEooxtD1b2JnbbpJ35no6AuBH21Sz1oJmdUXn65LYMlcy2mjag_arXFo04aEnNgU9ep-fa3T6ar17li8iddVgE5_V_rAV5eY5eSEYYpq1PomPgzYEpyQ8XlFT-FegDCR_cNPlqxSAX6kP_dhfYs9VfhIE1PioROiIEZjMqi239i-lvJkHacX-mYW8ouczkNJ1O-Wx1mbFUa1uv0z61WVLKcrYxI9DCcgHezmHf0YvEyqHQm6PuD5bJhwplA4a0zu3FSedZxATog0Tzp_Rv9R2yfiweGGrOBPzVrrnADgK954S3XH6mcW4MScHCcJ3EqYVbupjktNObOL4kqzBDmHjYF5b7yrc81pesyfrZu4N_DCdhzRsAbsfkVR1PNFYXpwYahQqTyeJPprYSbvSfBHgAnlPFOE0Dx7G-_JWglsYin2pkVN4s2R0QCNEhxnlpYKfjrjRJC62IOgpAR84iMs_9R8Qwsx9bdu3QJ4n1YFOGe2Yqw0VyMsMeZ5A8Cloox4w4gW8pbAebsJ658KloP5sNfYDgYDSixDxIcvPOQ4gg0nMD-BEHTkCiad7ssIQ7-_uy0VkJpwj_hPm-1osQDy0qeoXKFgiUee-Y1lm2GtsOemevAQH_c9qGtG9kNU-8xVwhfEafJ5TpY5xMAbpzvmiDoVspcRAgMTjtJ3cPsrK0Y0yvkeEF6KbSEOQM_ss7BShOR3RSl4b15t0o3C3hBAWsqE0t_pkPv2jE8CLXAT8Pjq4ITqAtF78qPmAS-fXE91kv_CkT0eNMg7XyZUjXA0eg3KGr3piii8&cid=CAQSTwAvHhf_K1Ers7iRhZOb2J8rbKu4NwdtO9N1smBwrAX5yK3YLeA2Gg-AxD20UpXQIUoMjIJ3T_-klqVMJYppovjLb66TwrJIHwUTMUBWKJ4YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=890000848875489800&adk=250412561&idt=70&cac=0&dtd=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.253.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-253-204.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3e4f4473fca40a0727af56eb13aeb3018c6d4901618d7de6531f001687267fcb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame 6BF4 54 KB
54 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Af7L9KhW6HaYFnYldQU_ogcE9gShCPa6shsjo6XF5K3Pq8YfNbe_nmWSY84dKrV4jvlmJUBb1jXni8iIqGKP2KYYHbCPNo6WPmqX0Q4WFRSIYcVbpoK-xUL4or36TvEdOesQzcemJxpJYnr31Ll1cLjeMetpFt1AMixUR4RQl1Hl7VILuAuXcEUuFkxtSKlObEaQ8D3R1r_D8xWFuPDBXCSUYIGb7YNUY4lugmW2a9b-wkbxQ&dbm_d=AKAmf-A0m0gvty-NAmpo46OFojYX6cVIThmT0YXNVfu5U_UUT440BurmH0iz8fFV4xBhiZYAvDe67FbCokSUNJBc4VeDdCWQlEEKcRKUDwkWTLZUUvpg-1Sqcy9aiFKR4gDHo_W3bx8tQxxHVPtuta2EXskPKUh9eXlLhI8oWIbZ12Ax3eZ4Z7FdNBU9Uzqlv0lVNkyxo3bICxHHNdGFsPmrdFsO6Zbl98GJBBD6-l7jsBcn2yDMxmV10lLGgHj8AvQP8u-Cfqcj2Avj1CwdotcByROPHge8QmDJCHQ3-6hQMIMbybHLUiLaRpBTvqVneu_24x7gNlM0uhUzOx-Pt4iTg6EgEmdl7mVlGg0_vfaQ5NMEeF38cwmazdiliJXa5YQ07ZgpZx-OPiPRMCiNt_HpBB8q7Wz_kD-uN1IEbd16bTVk7RK2i6cKDhEmLMKfJPXAq1fBsgnach2kxxCSmpnq_7fVhSxscBpJMiD_lhOCB2-3bSWMlE71JgsYm3ZxcM2dSSHfSpYHu2phdzaxOkAlxfdshWNgtAFIz1ykaFVnhxq9PI1Wdo8BGX5YGJIrQD5BJOB4V1wXuvDsI_XAo-tK690Gf-HycPiD1Sv-HaVt48OS2nfuB-Gic1dJVfj2ACxmXNtfOb13VR_7Ox174WDNFlJibbmA0d8jLZvBVJd0nl1eexX_wBreXS1BJcNE9-j5RtC-m0iPTboEKhMsqZfolBdrO71V3fpUdvRKCyxFHDXPWckrqmOb7bdOdDdWlKS3I9PAD1f1kYuxjkYk-kQ2tmoAyXfZ5J6Pm2INJo9zSE7QaSXUmaol7eWI7kDo1pUPXfa9oj3mmrdhHAigsluiQEBTtGmRnA6SE3gSssJXX089o3RiUsX_ya7WMDh5yo9p5b7iDqdGOB6ajJgIvNBoNv2bFHIjRYK9hus4s9U4Db3s6F7ci0UO9V2mnSNIDGirhEsZlFjHg-gKTNg9bLBxeBr0j7KOVk-PGNuAjgKMD4_UcNE56Fau0Q82VDumH0prmEyHc7DOFI6bCnwjKwgZJ-aWE_JbGs9ENXOsZ08l8skW3IX9Mic1Bf1S6F6n8XI1d59i4KZ-3TGp92OIXtxbCX0XGv4DA5XeuchxAXxsmifZTMc6Ybcy5b4_ntgL_AWWKx58XUwF3b4IvnsvKPzCM1T4fgUEK41VkfkqeLK5K015XH0qWboNLn6bdRLXpY5baPTjVf_KsqHZipqgscuzYjHA7-Vkl7voYKt-bb87tsqVBpHInyeEG6LDD3BRQAVSUvSKa3qHx2nC6jd5znlJnA2pUkMFJvV8dg1DO9_TCI9-98TSXD5qFQ_awJYcZEZkdiD6KsspJ2gAVaxgVIp8wqWRasE7PNtgTJrgJF-c0sQVFg2PW73EH7HIWauAQDs3nrKjyxQ401U8mtz9d2wSptQvYA0y7me78F7qr8R7U6f8SSk_3CH2YYZWiL8NKA0SsLutLNsjIMF7OpRy6ACACHQ8VE_4ck5HXEqmTS3vjGrEay_1tkw6Fqggk7pMBM2CZRbGN2aJdDm671d33O80qZisAGpVg9CJw8O-W1nYXUfxzxqGyZaXpp4uThWpwRrPH6C2p_xSg9E0PGtGJMC2wuDRLGQvl3x-NSxa8hDkcVB8kNb8LRW28B_Hctw2hYg6l0P1fFe4T-veYJFkayGP6zVGyIZpahS1oMG5e4DisnQ97PbteyR0HLRIYhn83qAaTu8z1jd-xqH1umjOw3zxtw-BGVd0RDq9ichzPcVqlb6jKFgReWX0KVGj1JX6Rg2YB-9sdk5boVGzsx4VvONc4mzgwQaBHpc7FTiV4ynUvSSHCT4Y6SqjzplS1yV0Y5BcnDASvpxU4Hn1CJwkRRhqowcr8X9sRB0EmeHv4eQO6vY_6TH8nBoQ1A1Nh3Ov0WuQJ1fXtzVNmd3N6TKpGhGGmcTqMZkNSQC8oDCbbbSOiatZdMnvY35ozMrLx1-PlWW5-M50hGb8R3xofDVWdCXAo4UTF-iG9fZZx33D_HMXOwyJpOAmzrv2hI4Ig31kAoi3pvjakIcaUnCj1k3JWauCfHousdTCvOt_WTYbuoe9rWSrj6TwCL6ZCG9I6ilqO7oGDtdrqEoZaZ-2bZhek8ZHODyIbjYizopwmoZXZVlRY_3oZVbVubpyLQqA3aexAHgm_LKSVB97GE2jrSt8t_kV5XYMtRueF9u65hp-GN34e5vle_2mJbbBDb_bkkiBOD7KpB5hOfVamSIXIEALtN9oA3E5D6bvH4CffG9jGXnOEqU2o-ixRXkSxIKnN9QZ9RuT9chnbwf3DErrJRxpMnYyHILYTMNWF1L61thj2sX5FDN95Om-G0glcPYngTObzjg6OSVdUxRvAUyWew8KphQzHlDE9LVKTaUSMJfuBWTcuEVVD-FOCtNNsTzNrqYDO8z3Uv6G_V0nE4KFyxa7lu-dZr5LqSzv1yJzKY2Wd-FOSH9OCKQyjye3a7Wm_CzAuAULBFmBNLhudosj0J5Ja_eZwO42SQzvXO0QeJhJYM4GNS0_PsdiclicZ7sdVO0rh5oeNWQjcUrAY3PR4MmBRklnafSkk-lIY5Jjr9y2dspDYDIhlvPUviolkIugTEayTZkLRcOaiWzPP8xA_JVMAta8iHLUtKpskynP98bdkApXj2npzKcf-yf5zMcrmdoJGCLAOEvaRunOg8z493xg0khkIufYVwUTq3e_phrvMjz-9YDxaMc1YcoD8pnzLviq40WiD45SLQByDWaHyl_xI4D5IAAcP4haLJBRjbuQf3EEbsTw1Y92mEm-uHx3F1zwc5Kydx41prC44WGjklMbR9ZBJtrHwEOH4XybpYlXx9Z_MlKVMLKSf2wJQOn3rtiEyB2km1-rZIXnpfESN0bHpmcgU0TYuNrtoWsaMVII8gAkVAR5W90Ls2IZyx-Gg4AZsFJOab6MgGhy80JArilM1pMlvJooT-EPb_S9hw4ct9BbO1EqQ8_4g6fwM88e2pQ_H7OvkEInB7ENp6S8m-3feFZebXcwte6oPHZ6nyN-ChgHVfFqXRaFvmNf_0pyBCpimI3_NKWTpVrt78fLGeb3i6FxU6sS9S7_X5GC2vuaFyLqcJUSxjRgFZ8cv_mmkMmnM_IXC36a4cxv16CBUJ9EmJmelSL2qlKsUoqu2mHfTuRpjB2fLEAjcuq4fv3uc_4aCQxspb_r_phIsAVSVtwiwEPNwQV9JD7C_ABs_AE43pEJ6yRtUgF-YUlRdHkju1hCo14LFZuHLxlQ8RAEE_quaoygEooxtD1b2JnbbpJ35no6AuBH21Sz1oJmdUXn65LYMlcy2mjag_arXFo04aEnNgU9ep-fa3T6ar17li8iddVgE5_V_rAV5eY5eSEYYpq1PomPgzYEpyQ8XlFT-FegDCR_cNPlqxSAX6kP_dhfYs9VfhIE1PioROiIEZjMqi239i-lvJkHacX-mYW8ouczkNJ1O-Wx1mbFUa1uv0z61WVLKcrYxI9DCcgHezmHf0YvEyqHQm6PuD5bJhwplA4a0zu3FSedZxATog0Tzp_Rv9R2yfiweGGrOBPzVrrnADgK954S3XH6mcW4MScHCcJ3EqYVbupjktNObOL4kqzBDmHjYF5b7yrc81pesyfrZu4N_DCdhzRsAbsfkVR1PNFYXpwYahQqTyeJPprYSbvSfBHgAnlPFOE0Dx7G-_JWglsYin2pkVN4s2R0QCNEhxnlpYKfjrjRJC62IOgpAR84iMs_9R8Qwsx9bdu3QJ4n1YFOGe2Yqw0VyMsMeZ5A8Cloox4w4gW8pbAebsJ658KloP5sNfYDgYDSixDxIcvPOQ4gg0nMD-BEHTkCiad7ssIQ7-_uy0VkJpwj_hPm-1osQDy0qeoXKFgiUee-Y1lm2GtsOemevAQH_c9qGtG9kNU-8xVwhfEafJ5TpY5xMAbpzvmiDoVspcRAgMTjtJ3cPsrK0Y0yvkeEF6KbSEOQM_ss7BShOR3RSl4b15t0o3C3hBAWsqE0t_pkPv2jE8CLXAT8Pjq4ITqAtF78qPmAS-fXE91kv_CkT0eNMg7XyZUjXA0eg3KGr3piii8&cid=CAQSTwAvHhf_K1Ers7iRhZOb2J8rbKu4NwdtO9N1smBwrAX5yK3YLeA2Gg-AxD20UpXQIUoMjIJ3T_-klqVMJYppovjLb66TwrJIHwUTMUBWKJ4YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=890000848875489800&adk=250412561&idt=70&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 339663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 6BF4 30 KB
11 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 6BF4 12 KB
4 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9558
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:27 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6BF4 0
0 58ms
57ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstNifzz_eTLeCirRfL28knlK0T9RgxxxUY4ONEb5I_XyrgGgdmApgJUERkinm_7pS2koOqPRyzRe9j0hoToQz_FtLE9SRYn7WflmflwO5hUy0Ztg0w8TcD48zKmFYY2X9pHqNi7n0kXWLRa9LYIYG3rz5CYN4n_7MPc4WxWXODU1ePF-97izJs5lzKDyifRUD-P51ZLBE1vI8pd4IxJVPywz2ZLNWf55y_dpMbqHavjmBm4g4kYb6jYvz_4xYMN46V3ur3zZVE2PNrCBpUQIK0uT7DNXaR8m1k4__pDcBtT6RvVE-abJmo16WMc8bkkPq56zISDe2K67YenSplcY46Zdpe81LkpCzcT-MPqypUsBFj1tk67aR7CtuaoNqWwxpbkSbUz4FzmsF0tAKzlWXg0myxONpmgnIDcKzoP9cWlxi_D_UMJi6yI32pvDLVh23YSo9zBp8HYovSy8rmwgpvx3-Os01VEekMns1UNjOJhgufuH0mRU9Vg4VbOGr9CHlrtxXYxovezoj2TUejc6ul3UJuu18kSmZ0OKetcC-nCiQHwsbTPpzUM2MArHtZkNRIB9zQxXjVvrB-uvS4szzDGTT2eEnlripiePleH0cP9rmll_pJ44MVXJmw2H06i208nae61DKjfZsAVl3GT8i2cVchNlAmqXxYC1DLBUTZlE7bzAzx2NC87ELSePTTmuEnmv-kStiy6gWtcygu07eRc1JHmbdoKjmDYGPDSBySB0EJGvomIzi025q4SymMPsJdrBuSw2B3vmMcsT6A69DViOdq7AmEpu0x8gaUbgbHME1IBqBKjwp2BUJaR-9wR955C4ePiJbPEG81gmnHz-M5p7_JvGl5F0E9R_MR3qfMxtlNRmGBPt4bgdKeDPEjhnNitDcVYPXb9e-UOwsUnotO2yEvM-Z_e8LU73l6zQDwdW3odSdfsvzR8BS6h1jAR4av5L6xcAVcqlwSzeeEd_fqlzisZSzrtYgFMRFBdwjD5rC6lUV8_EM3_AQrg_fwFZF8Js5Q9TGn27826CrzT6_q47xY5NhwQwlqZYtCGehnYRHOrcCIAOibHKemJm68KpdvJXHZjGrAk6fsbLdXFu-ci3eUmk3qFIWW9md0Oezt58RB-n-t9M3xlbE56cktRnK6dHBSSaGb940RrA1YqlYZF8Q2NXw2xGVOJ_qX1koWy4VoBuOFtcYaeVFJtAuLevlv_HXHsQuVEUMrq1Xv5MXuqJ0l3Zzq7493DZhXxD8PJ8pzpTzuCSCN8nSwigMA8sZiD_GdqED8QYuhW6Heq4eTCq_Zm8YgLw2IVOwEdO3TjBRgmUEuQM4WfgEA2xZ0vOYOobgQKFieZsxrJ5wUZTInqHIRGylKaU9zAzIM801k-yTos_2-rGrfuHCOtescXDdpaSjdCJlhTX7zEZV2S1v_nc91GnblKeMUSwuNnNRf_0ETQYuR2uTh_yuYhFWEiLTFmn01ek4stABzFlg2lWw&sai=AMfl-YTK8ZV_gpHV5TBDNbJlLV_7nteTDgvsZ0Mv0bDsHMDilpSyMt_nbsv3pD008lrqO1Avy38s0BuZjvpW_GukZRf1Sw4LGAOqMbyR8hQfSHFgLDkjcS7VKMOFTKZGl3SGFdDePlol2nVFGGxCYtMxf5TUb3QZFksMFEvMKCxiHU9p8jUQ5FyoILAQuvS2IGS3nlH7fM7ms7bpi0Btp3mXimFtZo2QD4lXBnEKjwSU_TZjnlOo4HIK0ypNCqs3CpdEDB7en8X5Jf8UrRy0l_e269nslcc3ry6JtK4Q4041utmnSnd0cJM88yYxRZxHepSi22pw&sig=Cg0ArKJSzLIsPjw_PYEuEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20240214.02388&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6BF4 41 KB
14 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A70C 0
20 B 46ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7618970600438&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A70C 0
20 B 46ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7618970600438&version=m202401290101&ct=76&x=1&cor=6806143219634768000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A70C 95 KB
41 KB 60ms
56ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CYmoknduH1_ihCQh2Y7Cuxw5Xf7IIsUSuDF0Chr91A5zdNOvMAMkD_d7-IsJhZnqeIKZJHfwhlnbMwOmHpMT-Fz9dD48Tw4iYwBmZKpBt9JQCf2vSNqssFtwpN5G_ahzZ4S6_yR5-AT_n82wXykawg3LdJwy0P342QLBOPoiaSpK8dDYqJMj7uvVc1Fpfq59IyvPkU62ZTyeIPjPZ_rPaQ4j3Fq3U7ZW3aikOk8Ma081MaANE&dbm_d=AKAmf-D_j_YxPsT8OzQn0-VDYtTojz_Vym-dvghxUpwrCCZSUo9OHaJAKUsKBpmLfwG832gvbrDDEidcavDoZC-83nkDu_ODvO955midL3TstdqWBzu36naB1sne326khw7oy5H8zKSQ_iMtJrOpOGe67HA7c2MZSt2dvbAqp2aXFJLneSFVPsvPAWyAE8GC3G0S_cRag2MxyHNd6xJqWYwtBJJReayjFFY1y48fMkbweGDQTnWIcmcS9o4rS6jKiBvO3Dk1FCju4gCTKwZ2V3n6eKt96qdvL98ufpzeZ82addXQeLBHIYkAuKTpEl7IaGFPbKahQcOs4NX8jGt6GqTfJT98I15TG6KBktpK400mOQjFi3-k2bPLwIlS9UrAbIK_RYd0HECzqv-O4M7kn9BJlU1R61k_k8FykHVC-XwIUiVg9MwJVWj_DGfbSQqb53n7VOAv59kvpQbUAjdZH29fd9zDa-3bGNdZUxJMcZUhxXRsR9aTiOM6-CbipdL1g35k9xBxUeW2CNFRh9xsFwdmw3xO01p8wOE6BoaLlECwvHI1h0J8G6jKeFzvlJUX-o9i96tmm9Gne5JLn4cdxJ2NWPfR5a9Yp8E08SP6YgIvnM8WrNTSVLFSZZhv8zOfsakr12aP_ZoY_a-InrfWN6jWWvjdfPEa00ZgxIsfdmsVRRHDvR9TIv1SWWX2aQw3ZpRhjUX_NF0iKYMmdU4Ppp9FNEcC1cMyIa99ObO9PI1vHS7Q0utTk-_upmPXTeN5DzxEjJRTQaQbRNknE7ey-NiXGGskQAnGaiGU7vDuaWnYLQcKwTxR-gGBbpNfe5MhASw05GLHaeUG3K4BDvmjpJmKu1tZ5Nkf5Osk8Pim2hH8yk8gCY-lOJPsf6ZAeppkXpo3JZzAm93Sp_-XkiHrx-eLf5IMN8rpOEyuqvN8ss_EDdOcLIl9d7kwmj3dAH_LCcUKsE69Lwbdc8v7P8h3isfoEz1F7XNjToDkPFS2yLxd5lou9dTTQ4bItQaeqUFcnloG8FSGKTzSwIx6cjgA7nIFSZnlMYAKxO4GNaLE-zrCcDgLiCVaAb4TGrnq8O3cFJB2zfqz1FPM1lXPpIR8w2OpD_vZuQVTAzC4JhstVEUZH-SCR5K-GBXSfVwHb4DpgRk_QfJDe88Vcukk2GXoHU91S91GqEZJlZsYgDmlUq77nvT91SNUFsoHqShwWNmeqWHYfUmnRlu35QcZcjw4JbHk9cp20mzmY_d4P58M-RN2K2vDVyDT3si-qyC8hyFd0X0SrQhtzcT7oSm-qWg-p4kNghc0hP2jmbKyxZ9xIWT3r14_QiPN_jo15p2X_i5L0O5_QN631pI06hHa0o9Rc4wgiqzYB-suGkP2963QfPbjR5jvDrCWJcFEI2XfFqAjb_jkk8_ixaLKJT732jm6AdznmVoeYUy49sfhR9t0DuSDGmYE6BuJzG0hlC3w4OblMckFcyE1yQqUwG2K-NcPy_HZgn406-F-DXECpMuXhzMqX2ouPGdjlPJ6O9ICcy94bc420aO0ilu0-uoZdYp3TpiLxD-ni7dMnUvKcs1cozs49pjO98ikReuRSNEt2QrZwwsIgEbBHWm2ucMm3PmJ6Ey5zJF8GB_-MHKfAtjhySe6yJOi8Nw_CafPQUr9W-wd9eYPtLXbOqyqOf4YO1Cpr519rjaMLtQBg45vN3uVKpCU1ruUyERDsMHUcXTBv7RAE-x_eNR6bxw8mDzj0JbqBc6QzeSFC1sWfflUBDXx6gkwIDJaIO6klayxj3yvMjq6834TOWSIf5zCzngyBxXbxiUyhwmlJjKidjlAmcl73oeTsX76db13hIBY8klgGhjLRLrm0hmiDj2uPJzkHonrV_V42GPNer6B94muEJtriKb-3lZvguPddOB0dOxXN59-HK97E9O2BXLyYiPCLlRnbv6r1puWd7Ij4ZKuxwgpUw2bOLbE1z-g8WY-aSIc5LQ7uCAcHvZNXdBogVnqdckiI2nsFl78EYlSKEV74jvnshNgwa34YrxKa9Evq3DpxqmMMXIdGWtH9zdWCMB4liwkxsyV4CjXfFEEKZhPdJ2cPspguJpTVtoZot8yhNFYNSR-Hb23VcQTALZ7t9tMWk6GVjLWobK6Z54ItjCaosV-SzaHl73RvTgwa3SWr45oAoaGzsdSzB1zMWpnlcyep5UDMJmM-O3peoVqaUTg5TRnDodIFi84g55mQopDhpGwYXrISPjL9mjpzZqrqqfDsfn_q9fj8bv_gvsqU0FlOXMlIa7FUmhh5iblwO4-fbdKyAbUemVJMajvB4XA66CKCxXTqGzlTDpN_gdHDACc8QS2-pl4v-_Q4eAseHr4YbcVMVx5x73ggl-W3qB9Tb6UplGHsi78GLyJc1MuoH8Ix3nv3m9SE0WyQ843wD5WoAgBF3rKl7Ovcnnu_6o75bH85GbBr_b7TQJ50Ek8yjODvbR9nPQNCqhEbi06hGlkjYmAh_hf1n79gM4JB-EqY4lzXpwComDC7TZN9xa3xZeh-c-iP29E7Pnxi8FaZmQmuZ0MMTeE_RfuDtqxz1az_djCJ6TdXB-eWwQvI4E2giapVoIldKMW1AJUco9JP8gKjnbg8JTy2iar_EWk4nyzeP4F-tYBqBOEktHJvjKg62YVQoAHuOwr6IoS9WQ1_Si82Ii2Rlawa9xdGtMIE-eok6FAYZ1AJ_8nG98jJnYfgk5zvmbJMDhWE4BzNtKTCDTOxyAbyC6upCUNdS6eW8yvE8VGdwzQDM0oy0omawUzi77xxbJW_B07splwFQWZhr76MQacSkkHZTcKRW5opm9fTsI4W43FFXrhxQF-jNtye5IeULiJ9S8cOWbotQHIJxzPXxMf_GS1T_xr9l2BZ0SUwoMEShqrE7haQYD_H3rtefCYWnrbslK1bw9vJaiAPF9YnE4Erb7XlPOvNlnvNJ2Xv0J-YJVmzwh_MYA2JaQH_67qJjITViQnJE-aDYCFQomY_FVleaP0Rywi-nKCwrOg60e7-ouduPz_PhL9kNxLJVdtU_87bR8kRkFpO5C2qbNIu-ACx1lUZ_EcLd_XmWVuoqsRL0lMFt9ExzOs3Sbtj3iio7AhGZbHs1YcRc5kxChJfh9_D3yX0BB_Psdo-cu97XXGspLF17XYl5Fhoh2aJhHynjjuaw0_0x6aVTmOSdCYQLA9nUd4pJ6Ptsg-TlKzBhltHAQFRSP_Kw-4NYxB34J4PweQFg7JgNHGA87qjoCnMs0QjXvXEPFsWTWYDXMtw6aFfzOxnbu7IJxsxgOwbCWNaZYKYJ5laBiAaIDHDtc6rexB04zOykQmTfTHXk51Q3XkWAFMpf25BYMtsIbA_6_k-IfEG6nZGbWYt_R0438UpDBCaMulzKyl0wgDkn4Jq9p2gZJolCU3NWv1iUcunxorGv6EpC9UcgHl7adziBwUTs1kLVyxrPOxQXh79irbvsBm4F_KPGektSDv6dP7k0s0ca3-VEreld5ZYHMF3Vdeu4SvxfJgdJAKUbQ8w0iR9jZlhuB2WQR6BGY0Vevh6x23ZYgYOZk_3gyGEm8SO1xPpw0csFjOe4AQXpAM4aIdRsNcTr4UlmTfcGol3WqQOn7euGVPIf0htWCVhAHFjx8yB0kvSV0jqIU26VuLLQv101FpqSBoZqyhI-0DUO1X0fTZ4WT7j4k9BtesI2qjhIgV4N249yHvWpDa0Vb5zWKPDpbhfT4ynqZevgFSzWhzbDB-alKCvo30YukVgvooikLVRQkcKL3-CG5vSfhadV_wBQL8NpoSNqhkYI4PsIH5g2K4duoZ4nEfhn_cbeQCVTsdUpYoGaNVZubPfGV7SLj33-Uz5xIWxVrLar7i7i9uYK2jhsK-GrgIAfH6titzf1sYDSzayOnJcatNF9nFfm1tNEybLZpeuco1Wgc_5SFo_CpmbgFyWE0d4APxaKXwTeaAu0p0UHvT0dnMK6NbcM2oDMByR74eaq9LV-HNMyVkORzJQCuta9LnDUbcjoxZAVNMXIIezpoIQE_xuWFrOfDRPk099ed-yS-F5cj4bfWugQ&cid=CAQSTwAvHhf_cW0OINwgf5afibv62M78K_F29uwYVk1gvIz80oi7_YwD-_JA-P_T8TFs9v9PkjureZZu7VNvGqf5ZMGBSFWsVPi0MeZbd42tMScYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=6806143219634768000&adk=1964084971&idt=54&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95c638e0ec174609fd8023af729da2a7fd8ceefce0384ee55bce52721aaaafa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344627&bpp=1&bdt=693&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42023
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 3FA0 11 KB
4 KB 42ms
15ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344799108&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9e50ce668cf92f24a09bc5e82bb6346c58330c356cb0a1b1c4b0dbc4811617c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4210
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 4660 32 KB
11 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/4091885870270390682/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/4091885870270390682/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 17:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 17 Feb 2024 17:34:55 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 63CC 11 KB
4 KB 132ms
10ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344824950&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 19ea08ae5a31d8239578534ed952e3862f10d0f91ef106fa32938cd2a6a2b9ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4203
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 css
fonts.googleapis.com/ Frame 3A7E 14 KB
1 KB 24ms
24ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:54:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 3A7E 2 KB
822 B 15ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 05:19:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49568
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 05:19:37 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 3A7E 23 KB
9 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A1E5 143 B
166 B 19ms
18ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2093
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 18:30:52 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 3A7E 3 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:40:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 3A7E 20 KB
8 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3A7E 204 KB
61 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 18:12:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-2
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:12:36 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame 3A7E 36 KB
15 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238900
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 01:25:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 00:44:05 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 8 KB
2 KB 30ms
30ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd11ba6c7229c854479aded4c539ed8072ac5349ca11a4189f48f4bbf40ee388

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 238197
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2293
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 00:55:48 GMT
expires: Thu, 13 Feb 2025 00:55:48 GMT
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 73E1 0
0 61ms
61ms Fetch
image/gif 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst0eKAl5zsqJxzD_K_Nw4gj7z-HdyNImqLdNAvfmbkvwvYnnS5IaSOYJK6E_30LAhqakhJk6DnudwWtil1zYRpWtWQqE2oeqpZLc6ubYCv7NKh0LjFjQZV8j1AXlyix-iWf1Ggkf3ggZQkhI9KMwSiSDNBOw1tTFl85GxiEiXqz2YvNCw0hT2blbj262ntY7E22wrqtYcVQbRvLQyH2SL_OfRvVZMQ9RnjmtSHehn5Vetqn78BgYbY7TnccLGYZBt-2Pv8aHUlBd0CbvbclOKGX-F1riuQtagYQjB_7e1be2KeKDVlCOFMd4xRIVY-lXoCw9W7BLwEoX1kaGZIjc2AYJLUnq3KaXX0vrJGzcdU47hu_qH_wEOc1lwT___W-A8uLNyT4y3EuRW2ACPUbrV5sPy5HaDnluPErr6lV9bepfhTaUKMsTDodDL62hHH4fnRWY90OAVzl49QRotmfcVDjfRl5q-9xJ8hJ6mp66rQz7FGF6-unt89mj9bPkyNqCmMY48GzOzZzX9KEzVFmuGfHmYzWtLeI2KSSRDbxTb55PtTWL2By3y7hGLmoto4kM-krXN1X_4lt1E56I8j7fd_rD2WfvqUP1il5YyZQRDfRYbayYLzND20VdKToRcRlpLQouN0HFf3QXZNXq1yGtXnsWLZL9u1Ug9L7gnQlq6CkCYyk0CS0tV1rlIysmZsbaQ6cgOroJO5FpWRK9Cjdz8HMVdR--KRNnWcLxBAHzHA1ZirjAsnuSGaARKscDtXtR4uuSr8_gFwHNUKZ2L3nNSZJg0qTeoWfVDgg41NlVzs21vJII3baZAdXKmSIR6H4EVt0Vkl8c-UECoe5q49tzw7cTifms0TEPBM8nMT7cbZWlbMPy0u87r8pIx71azqQW-XW6He0R2pRevTggD-thpgqQsalucf4q-r2yuA6M1jj3SFofTnIA_cnRxvUtmpvnSCwd5GdcGSw9X7saZF6Zr60gngK7GozOV3JA6UoSlM3vFoq5PZCFsBxlPwWtPMmVDoP90Iv4a9agvnZvZAiHEYw-feujwZkaiqxS6zhxIcluRbtRFdWCv24uHniP80g7J0hIQahH7XaGNN0PVhKd1JfT-yX4iYWcxKd8YwQ6XY5yl5DZnyC0tFvbSDC8BZsfa_nTdrgzBO2tX2V_04ljsjMjjQKPqSasoH58NuwKhR2avlEj3dAXaxBPC6GLKqd9-nXbODnj6XXGo7Capuhubqz_95siZv5q1s6ob_E7iYYBmCNiusigAakRY3TAA4BcpraN2i15s0tGM1QIiTJBWk9SqGACbAJ275_Q6Njy1p_2t7gb-jSAejEP2WBKx2asreMArqf82r_eYlk6HT2LFIkcdPCtEjaXwlN7RfOJknPRKvkTGf_E7xl0BW6UD7etej9&sai=AMfl-YQnyXn0_x_JJd8-qT2FmorUy3LEYeXIIgJZHNtNzjaQFFIHgVEJIch4PeJuOEBmv_iEbWjIBoHPyc1-uxThLkQ_uF6T2Zd_4cXtW6g5Z8G-K2RSvoNgfUJh3LnTmLMLjTcuAvnZEERLWHnRp-eLH_05TXgu2xNjk1_JpEzCxegx-txxMGplxjb6X5NBUFpH6d1K37Gj6Pu9FX7uMltNG2fY16EQW5H2IT2KOKMuJmiYcG5xDroIMVrISaWuLKNpkymztkt7-Ol8GJxkMDM05D0nYdszbI5uppyMhWeG9YC8FBlBP6f9m47k8v005aMuPGwWkG8d3yuZOfkaJQadayZOd-VjgFNOd33NpFdjwTmZLuyCvkPz88zhg6FZjeCsmDTVf27uQ0Df9fRVLpizl4EzC59pHVfjMAIgvTDduOuLHCjkYGrYngJmw640c58-6esxd4CZM2qOyevpn4Ml27uoQVTG3_PMJyBbvN8HYVaXyXtE0vqbGNSKYmKHcNWgBJNsvGM&sig=Cg0ArKJSzEBysWXMmPctEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9lb24uZGU&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=196&cbvp=1&cstd=195&cisv=r20240214.49154&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
DATA 200
OK truncated
/ Frame 6BF4 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cb929ffde43735a2cff82c7e3ba37898b3fa1a2351dbaac888f0c9ddcdce3b2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

request.php Show response
hal900020.redintelligence.net/ Frame 7C2D
Redirect Chain

https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

123ms
104ms

Script
application/x-javascript

178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2
Protocol: HTTP/1.1
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: c4252d73371907ac5ae8b1f8e5c0d4a1a975a00d0d2d1b8ac13b5f27390006d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 24823500183026304444554012602020
Connection: close
Content-Length: 1120
Expires: Fri, 16 Feb 2024 19:05:45 +0100

Redirect headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8BAF 38 KB
13 KB 13ms
12ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6BF4 0
0 46ms
45ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstNifzz_eTLeCirRfL28knlK0T9RgxxxUY4ONEb5I_XyrgGgdmApgJUERkinm_7pS2koOqPRyzRe9j0hoToQz_FtLE9SRYn7WflmflwO5hUy0Ztg0w8TcD48zKmFYY2X9pHqNi7n0kXWLRa9LYIYG3rz5CYN4n_7MPc4WxWXODU1ePF-97izJs5lzKDyifRUD-P51ZLBE1vI8pd4IxJVPywz2ZLNWf55y_dpMbqHavjmBm4g4kYb6jYvz_4xYMN46V3ur3zZVE2PNrCBpUQIK0uT7DNXaR8m1k4__pDcBtT6RvVE-abJmo16WMc8bkkPq56zISDe2K67YenSplcY46Zdpe81LkpCzcT-MPqypUsBFj1tk67aR7CtuaoNqWwxpbkSbUz4FzmsF0tAKzlWXg0myxONpmgnIDcKzoP9cWlxi_D_UMJi6yI32pvDLVh23YSo9zBp8HYovSy8rmwgpvx3-Os01VEekMns1UNjOJhgufuH0mRU9Vg4VbOGr9CHlrtxXYxovezoj2TUejc6ul3UJuu18kSmZ0OKetcC-nCiQHwsbTPpzUM2MArHtZkNRIB9zQxXjVvrB-uvS4szzDGTT2eEnlripiePleH0cP9rmll_pJ44MVXJmw2H06i208nae61DKjfZsAVl3GT8i2cVchNlAmqXxYC1DLBUTZlE7bzAzx2NC87ELSePTTmuEnmv-kStiy6gWtcygu07eRc1JHmbdoKjmDYGPDSBySB0EJGvomIzi025q4SymMPsJdrBuSw2B3vmMcsT6A69DViOdq7AmEpu0x8gaUbgbHME1IBqBKjwp2BUJaR-9wR955C4ePiJbPEG81gmnHz-M5p7_JvGl5F0E9R_MR3qfMxtlNRmGBPt4bgdKeDPEjhnNitDcVYPXb9e-UOwsUnotO2yEvM-Z_e8LU73l6zQDwdW3odSdfsvzR8BS6h1jAR4av5L6xcAVcqlwSzeeEd_fqlzisZSzrtYgFMRFBdwjD5rC6lUV8_EM3_AQrg_fwFZF8Js5Q9TGn27826CrzT6_q47xY5NhwQwlqZYtCGehnYRHOrcCIAOibHKemJm68KpdvJXHZjGrAk6fsbLdXFu-ci3eUmk3qFIWW9md0Oezt58RB-n-t9M3xlbE56cktRnK6dHBSSaGb940RrA1YqlYZF8Q2NXw2xGVOJ_qX1koWy4VoBuOFtcYaeVFJtAuLevlv_HXHsQuVEUMrq1Xv5MXuqJ0l3Zzq7493DZhXxD8PJ8pzpTzuCSCN8nSwigMA8sZiD_GdqED8QYuhW6Heq4eTCq_Zm8YgLw2IVOwEdO3TjBRgmUEuQM4WfgEA2xZ0vOYOobgQKFieZsxrJ5wUZTInqHIRGylKaU9zAzIM801k-yTos_2-rGrfuHCOtescXDdpaSjdCJlhTX7zEZV2S1v_nc91GnblKeMUSwuNnNRf_0ETQYuR2uTh_yuYhFWEiLTFmn01ek4stABzFlg2lWw&sai=AMfl-YTK8ZV_gpHV5TBDNbJlLV_7nteTDgvsZ0Mv0bDsHMDilpSyMt_nbsv3pD008lrqO1Avy38s0BuZjvpW_GukZRf1Sw4LGAOqMbyR8hQfSHFgLDkjcS7VKMOFTKZGl3SGFdDePlol2nVFGGxCYtMxf5TUb3QZFksMFEvMKCxiHU9p8jUQ5FyoILAQuvS2IGS3nlH7fM7ms7bpi0Btp3mXimFtZo2QD4lXBnEKjwSU_TZjnlOo4HIK0ypNCqs3CpdEDB7en8X5Jf8UrRy0l_e269nslcc3ry6JtK4Q4041utmnSnd0cJM88yYxRZxHepSi22pw&sig=Cg0ArKJSzLIsPjw_PYEuEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=72&vt=11&dtpt=72&dett=2&cstd=0&cisv=r20240214.02388&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame AAB1 30 KB
11 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CivBOzJwArUVQ63fzBzkeLaVXPPuzQBVhrU5csC9WCiWqAWdmKJ1BdGgVwSTIVzZS5VuWwc6CHY7x6odchhrIaEmY76IaYkeECI9BQxgrOpOdCCE1cg9iuaac-YkzeBImYAJe6r6wNGDO-MXcRJlLYMmPSY5mlFWA2YVsDO92P6TAKHdY&cry=1&dbm_d=AKAmf-D39pOsK6YkWxuVrKiHQwBiq9KXai3kO0VfPuvdf9Ugf_SivlW4PIaJx7HM6sreM64L7SO7B6SODHS78dH_a-fTIVS-GQgRo9nAfcrpoTBuywIm6nFFAU1fUMafcUDrZqbaeO2IM-nDtfyGkygKQaWFwsxN92OgPECHAvJIhTavHo7yP2MlQSO1mYPUoHn7kuFo3es-2nr1BVdLIsAD0-8odgHKrg6Eesd0W90kn3a2o4TeeHEXmuzpbK9rMsZE414guqE4yJeNYQMcwyT3HPZXr9MJNvHPaIDpg32RFFoP7PsU68IxXq8vpPAP1lk89FR7eE0tiLG-9azYsgX_se-9gKUFo3TEkpdRnre4NunqES_zR12TlDF0PbeEJn8g5BYpngurICdeizW2Rw3xQ6sRO-iolo1r887J4Bx-bM0fQQvULgpvwtYGX9AXoCFk6RSKHVO-ZYLsNGW56lw6NippqZ2zFEOo--adI6shRa2FmDryJW5JZ30c8m5PuFuJf9Qq3WjjIUoPxSkXPccQSxFElqO-MhUjLtCdLgQZxuOpYOgBVaWO2Vsf5nW05qsJlfvAOSyQFWxvFqKxFvoJhu9Uq4X_Do0CuPktSnoMApnGcHtnzWqUYT9J_VMdDVu-epF1jZ-XrU03ehtPEJ9X5SA5ALCM3mdLl1SOcs4Z0iVBHxSwPK4STAfnqrEZ5q7010YkV6ZHRE0wCy9oUZRv7LDosPEn24mQvWXuGRybmDDsjLOdbunwxWsLEDgXdGJAISxeAApwWpzNwPRwb2f0a5SfSfssUfEls2g2sbS7QJBc8k_hhcV8iJz7IedGZS6zaoriq4P7PEPwn1kCMR8OpPPddPv8KcAKo5jrq_obXqjjvwnnbWfxAWIPAQZ-4rRnViSsd9fqbnDlI5kc6Va_4JEXeAW0zRhtkF-5JGzQXUxqYW8ivVLU7uoJgtImv0zDvv0oPTLBe6mcypz8bK5UmpXcO63UG2EJbdUyuam6oV1OEQquyso7Et6EYoOJ3URBKur6O9E8BFJwh2pGWqyL7cQqBN1Ij9duo4it4jh_v4jCk6HTyseBaPYr33eQGt0GcoPKMxzAwpsLROstef6JLc7yZCu5rsjzUFLrjw9XLZqeZqbcpi2Z313vNwvnr54sz0JOcLF2BHZp3EJsOvTw2cCIxl82CPmpGuqHI1Kh1gwCsHnq0bnt8atGWJwQLKCzrpmAwhbhvEkmbSyTvaJ5fxQ55z2EwsI6afKeE3n0gzeVpAIElc7Spo-XTySZNDvtpfi8l3Luclf4r2E-bWsnQT6zI5ttJDnduHFdGcwqU84joyPXePgPMz1oIoVBtvrLuaUEWvvdTm_wAPSY9IqgSUcJB4UJLaEZFc79DXfPkUdqWa9ge6Lna3JU2c3RphmSNt4hBf_eQQh_eTKQd_bPPxtBujcJWsCya3T_pWr1AKvyI7UTPqg_goiKl7ycYV4CfUejGf9fqVqzCcdfNefsDzuHN2fu0dtxpi_O4NMyTi9oBbLwCiwGsUKlVOI2ZDL75VgUwyWcQ-6-F0xNj_LseSS3vkfjRXC7oWI6EF5cV-9O9P_h0v4NDmPtK7_1sEDz8NpqGvBhEgAyvIhZkylsRbxL9nAQblI8XqLbVTvTRNYzs7rxCD-uXQnrZ_tJlabYCfTgH6MHjrjUWgzhyU0m_p3wAl-2BiYRVsCWDvOcw9Glp8tSZS1_muD9grifYYySNGfdcQBfo0iZsP2y-7jyWXaP_baYnavQl9JmL1td9f3V9Myvr1sggg8hFCYDM6sebf7kLPylSE49IyFOC5gFAigZ4yrwtXEhaXfAO4hU4l9o-978ExPd1YsoRzPS_o0X2EkIy9EIt17P4ctnrWvfxZjuHZEkzpcqPhOaFHEYmb-Uz_F9ofW7-fLpK-Uxk5Sa03b1MZyPF-ndZye2OTDxaR3jmU_J3kRSLRXXr0_AXKwIlTjBmsGFFnyVYf10Oyr2ggpvqc1at-4MEldJVx101Hcs9SRiGNvew4WfZb-9yputvM8RCEnPd-WIp9cI0iYWy2TpXLfNBJRZBLsbbgAr-P2faM3oGHQt83JhhRiS3zVxKy9FpW31fy5TzcD_s_-tQTtusQzHF12jsSQXGoKVaWzdIPQNO0DIQ8KEXAMRUo9jArJHL_0MoU7aYmgbKB9wpL7-xSfswHsc9YVtKPzXXhJEGcFGu_tVkhGDy2yX6i6h69HCJtIKZMqmBeWKitA1J-BcQjWtgVWJscPwkiEIDJJmKPbPagtPKeFqRjkAJW7qnXaPtJgengMuo161r9poOokM2Z8kalkrWgLlAcL_-tlu3Qm3M0Gbuoeff5OmQvlpyeWZPYtw5qxK3gZ1VKYLDW7H_U_UdLvyKDAK9_8NFLzfJKKTJcCDEfYBzZ47Cb86vFSOrcF9VdRFTzwMH7qg1ntNcEVOdYU3hYtauWb4evx88qiWPFCA6RRda_aRR4fidEuVAMjwGLy-6_ysVgfsNx-q2fqmkwmPkmFM1bpMYINfUEJaqoVKBCigg9cZ9qNuk3uPHUBiPt2xxPWKDD76aOVhUzJnrHFY40aM__hjaDEq57MKbfOmbANWyVUTghP_K29AcbERsG76XmSbRP4XFROD-HHcM0bZOk0bFPaGdpv9sjfFfMVuSWT7Y_g5bkylkJd0Icw-5dvSgDXYJ1I1XLTPSs42UjHbTeMadpgT5qeevc8WkE0OC2EqMLGURmvYwHGHWs3ynsxBOAgSWOoqqw5O7iW2ENRXrlSJikIz6UQeOf-Ums-P2GVqV7IaBEOc8vkPyMO7qyojtrs0fNrEVoZ_saAMlAH8dTNxM9T0Mpm9_zI7DbjbaTjqTS6276oM91M0li7_k_NVOpy8yWdWHMUXDa_hi4Jlrky9FlQrgD2NgDQ6nw_GDSvGK2RUx3XsBRDieZVhUIurO5GP_IJbsbm_1mq1tnXQK8RvcCvIBOP9hqrIMEa_CUNiJDhtobCq9_57czrZA3o0vIw2sa_kaBo4TFIBl1mSgr5AXNnGrvvLeUZRMzXzV0ZP0STdjwBFVl-T6iLYnlE0rxhr5WcTWqDmvxQf_itywpR9IrZuP0ljBWjdztg12UtCBZhb02IAVQn9DE21Bpk9gcwRCM1E-vev4vZ8Rf0J0gxXmiD5PZnZ_YjvVg7cFnN67H_0sDmFbp0yn8012YCLuhuXeExSG2uvvVkOYebMcs9W_j5ChBKXXz1VtWK2AuYNoShaThNVk6yIG1-BhStIYg3mcDH4cYozeyn3VCrfnlmKmDB60aFJYRSk6-WzmJV1eg00KhtPlII52VEX5kPqahP5Lm-MHf4T8DOUHExBRcSOloV5dxQCL1WQkvDkuydCk7CWRE4fQwsJdsKQrlYtbPxaL8eLKg2OwWGhPvAb6czWk4bWiM-0WNgSlUdv5aJoPuGgOkK5W3RxXmsKy2hPKZtZ1Kf0_kjqACS2VmWRSEPipslhX3S_MEvGIkNCeiSdQUeX7a2ANlVV54MnlMKHA8lSaBMu5lhQ0pIiFN2kBGDkJiYDJqBmcfN6t-sy1keok1Ko1lKwt5OzTUQ81hHsm4kFeolmNBhLF7FYpu_2Z_iSIktgErzFkpviDbGu_CMC9lE2Ld8aEpRoKNaxSlt3pjXpw2L3z2wes9ZAnyPv-A2ub62YQ8yhp9F_JzatJf65Snc2mjB69lRnrYktXSJYf6APnkpFDqhptZE8C_wXmaNrpxrrejehXvYMow2y1GYrp6mSF3HYXRUmDceuxJxR5rSbMSRJpyrfy8jNnCylw9VdPUCKB5z39ISZD2rAXCpeJK2cpMGsshPIUG-yTlOoPQPdzp4sLmrZyFRibOX8SPLjdOZuwRPo1TNSM8DdeNYlznnvsGPHHn06xd33FgfyML1zHltJKEetTveu6XukMbxrsH_F0TgaYEFiXrMM_lN2fcN-kFprm5uR5LSefTe_jFnzZEBNSf7-oBgbB4Y80OTe7a17If3bNDiZTu5DFWmdd9z6HjPQTewVdfCoadlbxY3HMCyvATASvTabY47DR61VliHgwmrTvbhb2NCHfx5FfvrgOEyt-epPa_2v8O0b0RipYHmUHnjRzJgj08V2c8MgeOX4nvESw7Cb-sEoJCnq3fLHNpOnnzkBQvMqwmEHIHRlWFIzOEKJwivL7p9SjZbebxNV37XUO6xWsyANok5UAje7vwVdTzKdkb4&cid=CAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=12259537849476438000&adk=2857193499&idt=56&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AAB1 41 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTQ4MzE3OQogIHNlcnZlcl9pcDogMTM5ODAzMDUxCiAgcHJvY2Vzc19pZDogNDIwMzA3ODY4Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame AAB1 0
22 B 44ms
43ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTQ4MzE3OQogIHNlcnZlcl9pcDogMTM5ODAzMDUxCiAgcHJvY2Vzc19pZDogNDIwMzA3ODY4Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEyNzEyODEzOTcyNTg2ODIzNTQ4CmRlYnVnX2tleTogNjA2Nzk2NTA1NDA5NjE5MTE4MwppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjQtMDItMTYiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NTg5OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA3MDY3CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4xLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjIuY29tIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0CmRtYV9wcm9kdWN0X2lkOiAxMjI3MTU4MzcK

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"6067965054096191183","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"12712813972586823548"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame AEE8 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CFD9 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=122565793888&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CFD9 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=122565793888&version=m202401290101&ct=77&x=1&cor=4511637126189661000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CFD9 35 KB
20 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcOWwCrU4lG2Fc9LnMdug6Ng5wSDGZ5N1Bo8q4bORxSLgslTebEw9a30gC2ul8kI3EdVY-bkJpIf5myEs5Aq73bicqO1q5nzPYdhRQkvGzby-WKq1QE29zNAEhwmYhb8J8hGSAn49sd3Eg9hER6bQA1enX4AcpvdpbuKVm_yjU4Kdby1I&cry=1&dbm_d=AKAmf-DfSsnxNhrSu5y-A3pTLNyn9Wwyx5CrwxMzcURhWF9J3lgnDk_mfL4ZUSQKfldcn_vE_tlDAenqPgFpEiwiVMESe05oGjg-HUPSSCLYSpzfnmDg0BPo2wS-j_fCbUw1eytSJ3ZqGGnFdtNHZBIcXSbtjJLMV6g8dhqvAH8USHZ4-Fe5uyHe2BAUlHwMSmiLfpEEIoLHiiTMcplfLxd0fSRxM5d0eIPgnk8ajL2OU5qFtHvQJ5u42PxALhQCOYsmaBVgO8KWHrThmkjjZeLI05LbxqFCrr_Pcqc5HRb8LprvQXG-9KOwCKS837LXtVuW6KXauRhdZtGtKDTeu9x6kKOclpoqlZtOjx2KINxmSXedPzFlxM7rE7iWTmFcKTiCPMpPxBJy4IbktHayF7FNgnPYzUtB2ey38qcoQzv0Ok9rmDkYb9MI4colYvmXYtPhfzrHIRpCDqdicMDxzyfhJuNo-gvLT_Ix6s1KwIE1iUzi6vh8-D63aaILSTfSbGzdwoGS0xFhUmfrNlcU3ojXZ_uIjm5V0Az1tmauCxCpjLY6aBw_7Z_dDW_GpK4HXXSVUsbJzKNuLPsA4bx30sU20RYx9DMSflN-saY2sFBA2dMo9HxjsvUzPEYkJieKpcHTc1bftga1xbTeVDUTKw9guDozu6xSp5Pm54Su4IsHmZSfnoaLBJPmP2hpjXZPLsBbmJW9gJjOSG7zXVieeyTugfx04PPxnoMxiFMLH0RdkXlphvrcdR9cNsWyf8GGYtMTG_PIDqFiToV1h1Mo5VNgipC9n9QJIMa4sbSC2UWn9oWIHG6dOS4GNv_JlpHSodwrVT0kQ9tG57XAYqIdhfaeAh3P_ltYzs2sU27k3bldaxZ4fjVQX6MBwxzLzi8g-z3JflcI8fw6XsGL9zblL-qT9NXqXJ7TByzqTKlnyHfxyKKMGOoXs-IwNdLRTFyRevdXD9ICb9kExQCSlzadylAswm5Ho1i-3ZLeQ76klmmvaa2ueII4flKD3uUJNgD3DQRwfFlChxH0cvuxBSsP2Em6P8VYmpppjCso3YWsrLUQpnWkUV676yiSHhRjDOYCI_Cssh_pV8b9GQybSTg-rRIDMXae5qMnRJ1BoXrC4tR2EExsC4U8n1MM97VHUEmTrn5Evm5_pNtaVXES-TbyepG0YqQ4rMNYxao7dMmSA8TH2rvFnnv9JCw8ZKmlKLBiZkwzm03XoPNO6PlYzziS6FgCtC4xxxQ1rdLxubKcbwTmbCHswQI4EczOUO4GBKzwc5ZwG3u5U0WY2YKyIPzyHzj3AlIlQKHHqTeDNQWjvCM71jiz8WAr1uUYC45CaTfW52qa3WhESa-pA5zZ7PNxMhUaggXhRmdydA7UbMYI4oIQSBNLJxonq_cvuLGg3kMpbcF6HT1g5srop1rWB7IUK91exet1BXVKRapnWFDpnC2Gu3Ade_ja1tPIWb0fqhD07rICMxJnQchrNTvtDL5BVeM-0lFwklR6pDoP2OQsVzVPC7Uqfgz83ZCh0i0DGmxNqGVI1nUnRWlX_nVYv8qB12vO0MD7z3687zXXsNje_np4jAluSxt-VrhQR2YwHdIzO23jifOmQZYRVV6sLN2b5YuSC58e4xcBq8ac8bsRzBjj_rHjHcvJsAh_HgZoWxZcIHmweF5etNT8CDOBJmLUbVsAEm3ABtG1SW0GLXHymCxD2kkpVeDJpl-4gHyeZqz1PKhfDxASdKc1Rz58mqiySFO0hJDhF9B9GNv2BcmAAbz5kzFRh5yo7_6Hhkc4zCybZOlL_2MV_Rl0uBbgI2UD-7-CSJnnOhRAzv7tYaK-UF-featndkg7mfgbG5zK48n2KYAH45pc4wcZsZgtJm3s7pSE2lo2pAKpa-jM4gfgRJy8Qh74qgxV9OEh4-8GYWOO4dF52Sq9GRA8xDRZWYZALdKur_Kn6JvUGY7QSL9trjlwFTkHdOft2XMtpxBOkZRZ-4oR4i8whAs5t2d9wRPHoPEPixB-xiYoXPWS4nTkhkAt-hUtTj_t3NTDtvYdO-CjN7zdfEUcqGpBgXRBWFeFGpIO48g2LrSCssX61oWxDXiflQlM-cquhlTNP5jnpbDF3wpPLHK_F25PupRnEd8R4asWh2X_2TrDw7HdQkXm41xmC91LmN1UCTWOiIe6kElFkP1dnWR1LDXgYLeYV__QfpjO_nTSnSe5hU5htkx0-w7bOM9twuOk1NW54g6oyU-nKiQ5etokLcl1dk5eZn82IDWIWZdrxLA-MBchkRXFN56Wa-yG4-nqnLROe4FiBNCqozCxwmseH-gkrGCyhiNttN_F4hQgQK95TVSWKGql54cMh1kRbkCnoXVx21KQPVIRcID61IOs9cr3l8hXfekEl9iK8yNm-vfWPCmciy1ePmmQ1IJ8vf8DHfw9Va4uikNrM-I3dI_vQdAuUG0tJBZWqkE0Z5nPCWWBciSXbmZoMyLe2Z_EPjSjJ-7HmNVWNq9ytbpf6nz8sWdhqg5-ACpTJLmqJ1dyewaF0_RhxTvwuDriOYFYqxNijA1GXfYJx2d_5Ihxbps8QhWp3pGZcvOX4TkeRCkvma51d3k-zpFTohhd1kEM70Uo8mtqsP_k0SLDBfAu-10fTx20ReUD3amuCsUL_GpxshIm64JbHektg2wtva1uKZXpVLiCtJhw2p7SbjqJGArviBnpXIqTZVwW2pbl2FKojZNHbe5epggHyvs7kFPBrWxEJIV-__qZI0eZxntAqXIibQwTjA5m9pzoPRJfF-h_7-vRdrZ-dGn-gQvKdxbJGcWtBkTeax2Ue4i8rVVyE7Ny7CnFp-trTI-1Jj_66KTTAlb3fJtZLf2vN849z4JQv9YYYaqQkfrMtI8MJu2FMhM5cr8-4aKBeXv5AxuMfDaNyhvoUfcsmtNPmO-MAMYP4QRJqTj7gRonHGTN531eHGaOG1Re3CXYgzUJ_b01R97aOo--zWv9VAYInA7S4MoZIVxYcwOGSQPMSh_6DLFYBUIySikNextrMQGjj1AqIG-m4HfeBRC8kOA7HwGs6m4Wde4x_ZPV55QVYTslEApcH1yBKlpsdCAaA_Of8p49q5gYmUVhMaRvTW9TkxffFED30PhNdwBB6qqEI15FE2U8So5qkxeLCQJYX7IHBU3O1YxCe-o6q0LNcHmy7ejBNKuy-KemWky1wl_l54iK2IWg2dbQRchAGD2Ksuqt3oBzMWqkc67DnFE6jhQvgGEmaXEtShM5xpQmRkqosiKLNf_oegdWErxYnw_ALQ6bLqCgRA0gMdNpTMGu_4-hY4l_avEao7zaXAcO-aS1aLBDe9uIMYo2to0Vddmuox-xaVuk1gQiTNWco5aGZbTi1SrnpiE_QG-U9TjtJn4kIlVGX0kExWK6TyAWVN-f_XTQvtWuQB7KkC5cFjDTla52accKsrhNzoqNSP6FBfQpmdPZIL-t_ghV-oa1Jmgn8pWojDY21hZebhRnNsfUkvjJcPtHGnvwZvjwW4MdgQyewKvW4hFTTK7Q0qIuldD2vqUE7as8WXMisgdiqqjSlpkCHvm88OI_mSdgml9gGXybLCh2tbD2ZEuHHthyY8APHkvy1G4Pjj8VC0oXlyAkei1cQ6tE92GUSv2qYiuVJCpKLT7b-75rnlz9GIitxreV5f-juXVOBEGm7LZCp_s0t9DTKgxy3d2KABWYqKY8mZbV-a2JDnp2rEgZkCD3D4a2IrFyUzyyvprSruo5zt0dABXtlbK5fsPYBQwcPUmSMjitcXBiJ54q1W3QC1Mj9kQVVO8MHbjPuT51Svy15c3Csqnzle1bHTojMvQIvRfWEqDKvUJBbiKQH4Y3fmATp8V2OPOt-Ly3eFvW_yEZIkU_UR6pg4ShSrNSm6DY6fmVQDSapNyKtvlyXwR4NRXYrsFIgYc6XlG5xDsByWGd85_y1Zhpn675f_zBGJJ7vNucHx2yvlt6A11y2DTGtT-Wr12QqruPD7D8jIQ3ekBbdmwv0QKKKVb4RN_fjVGg5-AAw8ZGLHQax-HmD1YaNQ3dKh36CIUp5lGl3RkPMOg8qvPEImd434XknZCvg0aDcooEPQ8XLO6_rIvxdzWuamOKvUG7RTaroZNOUP_fiWW-eOCgn66Hr9C88yiRD42WI6IAFyD_xRXoAVxJGrSPYqd-Wuw14hXxmoGiBBPQe6jQyCCsD_f3Pd95zUP7lRenAUw&cid=CAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=4511637126189661000&adk=1033480540&idt=169&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f8a20b74a92cf1fa043f8272504b7175a4b1841376bfea4d9b00428c84c089f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20028
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB4E 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8121961685020&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB4E 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8121961685020&version=m202401290101&ct=77&x=1&cor=843387727915097300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BB4E 34 KB
19 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DBu0AjCkNBDmdqREzFnvZlMe4Ci3i5fgeUwDvxaCe_v58ShQDCd0kmry5gla-AEHMO2Jtdg3Gt0nhPbdbR88HZjDDCJYBwyiy4iTAWWti6DatHZWDKAw6QDJkriJzV5pD2V5p_wEP21QG83MHPc6Kc9RqBg_GE1Sc621xjnkYmtHlHc6g&cry=1&dbm_d=AKAmf-D4-gBld5zB5VjSGgno022d2G21_6T_Xi0Wp1DVDaf3Nq9MKJZILx9n6-cZBSBTA5PqmVfUYHrdzYZ-q1mwKTa8x6lP2IcVIY9ijBbCRd0pyZCjGzRXA_KRVeKuFH1QtytT6NrcUHnNaKPUhhoAKy_J-NtglPfhmK6M5mt2cuxA7ynubXeD1GnfKJzrVQo_1Yt6VWFR9VQHqAxX8_uFoF_p33Ab1bgQFHH6pXka96p5GRJ99EYfnOS_g1V4byFfst7lRgnyWD5Gr-WG4BXRLuxLxVWqWPMeancYRbeN7-cPMwY2WaW_FUL8oUSAumhrdgR0u-vUoOyRdBpdcuxiUC_cknvKx__QYuR6DoH_jD7171BkLSgQ5f-c77Este8rif60JuPS4FUjkjbY69n12-ZboU0qRyz9LUjBB7A88k-kFRQyREaoOUKNtFaa-v1QAyrCpIeLw-HaQOheSfiTRPE3x1zBfnIPkEQolE2tIb_7I_u_4FZ6k_spEgK8PvSHx4C6B_11oZ-2u4a0pynkhQk5E_jmg3mRVoWrit8XtlTbEExgKpI5mzAZivIBD7bbupJLW7O14hS25ZwkyetdcFAT7Mrrsn0U40GzMaVNG0wzJQvtB7ikmZYJXC8gxEH0gjdPXJeIqVGBup3PtW6JJhD_Ig8nEwGpcJCvYIpdjkkh9_sDdfdbv9eEssOppS8bvu9MLgwrE1-DDZTETZR28eP6Hw7aivSkibhEG8ASNuv0DH9Q5EiSJ-c-S468jp4XWC3x93xR7iJ1zNJrL5ZZShzsd1Kzsw1LrTXPnwkLhXURESvODyEjFC707hKdMiY-rw_s2b62kxQlH77lumSnL_PEBl84_CalWLEDvPVM55hd6mPgY2m5J9_kMEYxpnniHhksv_Wq6K0eFxirH2maPUyTTurCeuzNaDxTWxsg-6V0JHd9IujzJP6i6P91_eGkozNDvtzYe0pTSP_Ec-g13dUXKJobe9TFOA4q8hba9_D_-WhRNiCksmDpl11TzwcHm_YvfUTntmE-X2LkgtB9j7_zzQ8C5Fq8-_d1vmTpHA924-EGj1E4yYvWXAPTA-900G4gC7tk-RuKYkY0I1Z7qXFl4BrHF1MneloXAF35Rzlp9NP41OxgMj1EVBNNBVfZnTTVmWH1oN1fy-7OX5Q5jpWOKeOWdW131Fw-wabAOhL8q606XhiTbc7D8qcHwqgG1UG8imMYJBQaYufuqvsmq9okOPPthTTcEAZgyoOxWjIg20edzsa-EwC_0Lv0vnssY_tkowsfdhZdusdYBnJ1c8NoHWbL_ZZYH-MoeYC2IKy8Y_3A1hpUS-rnmSU9maC8UHWHmLiC_zsLuLI4kpJMLICbL00HmKfLdpeoq5s4Ix9YZpGMKGJegH_q5d53xp_DCFAC-1QmdbgZddsrW4ZD8Dll-61X6YT-N0pEN_O6P2GmjC9DHkF-x7lUO16k40WKHa2QonWFz2LUCPJSe4WT_R-y31yAhptqAK0jllEBuxFZD_O6OrQj9xug5Gb57agyFFu6j_XrjPABmFeG11yJliRv4NXiLT0AH10xHdK8rbnmRYz0bLVlIFSudBS_cfpbSI8__FnEObrv2mXjZChMdgPKjOs1SffyTGax3DroSNodQvs4qjD42CnDJdnT8Sw1Gk6R-0kpP59_b9ELE42wlFKXlNBHGzyecif4cMnSukbaK0mqA6HzC9pLnFxdQ8ZHI601UX08UXpzu6xkcAO3jyafOWMcT1NHvSlEvQnV4pkjLOEjwsp2WODS_JOs_rrXO9V71Z5nOgkKCH2vA5KcfL_j9OsrDB213I2kcsdh8k4T7r6fpZ0Z57EcnrXBl9HBcCtnbtnzDwRpxwT5ULevpf8VJCvSgB_1MhZgeyk2uDQdtOZCxy8VEr1gHhgrBbwGmmu5b-81GgoUUtCK2Bx087TS45BvhcTUIMv1nNlgtjrXQBk0AEv_dZ03z0mtzfKA11w3aQ1cc0v-aUnnR4BTzBYosvAjY_tIIxUWTtwKYS9E4AZoCZWmeaxmKNFh_kPqretkRpZow8mYX_qQdlKl_w_GUiQqEZ4QIyBaHZr72sSHEWs-jtN0Qbpzp6ATISO4r0X7xl-Xit_nfdTnHbfJxXb3kZUOLWzqbS5xdSVv8U1qfIJRttwZlDycQ-gMDhGtHk-OFRGEWbI54hHwJAvkQ8DsCqHOmIqT4hpEIvpwR6L55TZElhHJflhgB4ne1F4iNrReN6TQihL4V51fKU_L9ZR0u9jqmrD3vrkm42hCeF-SYpdbq3uYY8RFsOpUwpc8ZVZsxgd2-72QeB3tLXX22p2nTYBlRBPpoOgP4bk9tumDn4dJORunSUdPUMBD1I6vOThDn7migJ46jsJPoPPW2uFUISVaOKmXnmoWeWMrIlzbfUCBA-uy-qj5OLLw-rMuXeYXwe2ZtPyhwfc4EkH91CxoUUOGkEkksygrPNa04fn0xJk-B6BzVfhCjjwCeTcpK_wLENDujXS1po5YnM4_aJHmyYLAFWA76uauvRDAhVpSNVzbjR7nG42poa-WSpv82xS17KVMVSIfjjMYl4jgq3EQ3deWkdZIO3C_LPHr7L76IXltuchuaBfxvpJXxaQXWBcR4Md9XCn9F1adUNtg8W5OxQnND_5wqyDn1Im0-05wT28psv5qBIhxRXPqh7fnq_dIs1C-7UEZ7a4liBpd8iKGBy9WDcJJ1VJRAKxpqOFE54my-_BysdIl7GsF_zKQ4HiOeoigV7fhix0aMDsa1YqhYm2uSBSf6D93h8o2RhZkimhefG760xUrzZMMOVVM36Ecx61N5O4c1Z3ecOtSZpFTSFJqDYEth8NlYiOEm-GnBnkxUyWLqhj1jNRRVdS6K1ZpN7vf77RZJRGdLlC-qDJfO0-ZGPFOS2RnOQ0dky6hmVgjJ0l7DDWBfbtbpldA_yObYF-weeBMh41nCigwxheSWMwaR9YKosx5jSoPyXejGm2VkdXAqE3zsN-CwDCCWEJoM_Et35k9C35FSHXiQ79A8Dp8jwFuzduiXpWhuBQXA1JFmkn7lTW9ECQnM7Isx2k-otQdAc1rJ3oqaZ3TvS82S9adv31KgBbaxPWfaL9KLKazxEGAn1rEQcB_97UdmpB5QWF1ag1LDRlvVNS9MvaqIufFf4CYTJjud0LbyB9kb8lDlCrCa26qX_-poOeJOAFTMb9YybTxel8To3wgYC2He9GWI4ryH2-XkFbiILCvx3lVp4r23yDg_T6GSZu_Ms3nSgR9PJPRQNSTylk00CDQV7rjj8OZM2ZS4VsnpuED_8fHpwgql8ILWJ3HOltIUCiX4h6ZkyyXpRDOdluoNTJ9N352HXz29UB34G_FTXVqyaYqj8gP-mXy-3L7u9G0l9aiUQzdcK2yE6KhYqZ9pg2o3qUMJfSTJlIGa0Pvqo1wfiljq_dD6MGZBEFvUCqyKobNUfXZCnl_z4bqpEceZgc5B5ZEgiZ1VxksRGWLYbNgfNHlsER4PHjcOQb1KeAQIKhpfV2-bCX6EUVNcguVF5ZWtluXj1Bc68M6O-tOhp7j1CjkpRvqRdHJlumzxsIJVeLK5nf99e3esVCcfQaRqF8YWCmdopjvTe4txk_w-so8dlSBLqMSZwIE8P7x3CoeT_-LbMwCy0Iz9-GaaDWL_PiNOy722BOLlfImdYIo4LayLR9WZMIXBlkC8WKJckJqMQjwxO3h57JGI8rFvVBuvUk0VWXVS8cO7GD0KuEtK09V1hvXDxGy4Y7ikyYxEsVegY1I5ZzAGOVFY49Kh8UR74mSxxC-cll5bfdzWlHAIJgCqY6e3djaYNfKViOtDt16Dc6z8pglMIyMJLoJObyeZxX0_VjO3QZ-oXqV3dLNLu5jqypAmtFzRS0gRTmeJm9_FbDweRsGPU3myL1p_nQOhzCeJ8XyMzlaPZD_4egBmOmDg4KLCZ6hlXEjvqSvQpp9Zn5NOTQ0nSiR7h2FYeWKotHE4ZGwj_oaRK6IBXzi70x0VxXIZ9vg0lClsnbbQYPzXeteLDbdWoC5FEmhLSR-6ew9gDjpyQ_ZhILpQRxTiIueMhwDAwZw5IktMKtga4qRXia2i2A-GiwSQil5ATwFCTcLn-GkKschbJXe6xdxdVjyOgzWVANcWa6aZwltmu5nYcjxXJUESkTGmW5pKiXHXfHZqSD7V7bw5_FAYGENrzuaoUphiy9A3ycHti2GH_2K3Tjwg0Sz&cid=CAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=843387727915097300&adk=3944675603&idt=52&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

487a0b6ad828c675eae22b1e408416930563656ae3946245c889934b9865b169

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19852
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame D4FC 38 KB
13 KB 10ms
10ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C25 39 KB
15 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
DATA 200
OK truncated
/ Frame 73E1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48619f7db4043c0160aa7d4c9d17667a3a81a54a5245c073ed45268a216ff6ff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame AAB1 11 KB
4 KB 66ms
8ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344824522&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7a6d3f627a47436f5368c5a2682264acd2409455231821863bdb438aa45ab706

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4206
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 hp_styles.css
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 2 KB
918 B 13ms
12ms Stylesheet
text/css 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b29865ccb285c272f1fb536023626f668f26fa499e97b80b3b1de5ad215552a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 17:35:06 GMT
date: Thu, 15 Feb 2024 17:35:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91839
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 888
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 tweenmax_2.1.2_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame C0E8 113 KB
39 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.1.2_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a863a77e9ee263a0ec9c1e792bb33ed0f663582b7369f472261df7b6040990c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39910
x-xss-protection: 0
last-modified: Mon, 11 Mar 2019 14:29:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 CustomEase.js Show response
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 14 KB
5 KB 15ms
15ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/CustomEase.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a30fc105419c6d4e451bf35ce8046b3023ab1a60e17e9f64b5c5edfb6096fc3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 04:55:10 GMT
date: Wed, 14 Feb 2024 04:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 223835
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4988
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 hp_main.js Show response
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 7 KB
1 KB 16ms
16ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/hp_main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a770d3adcebe7a43b8f56ce2f6dee366e36f1d6f419784bfda45c971bf03a81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 18:16:04 GMT
date: Tue, 13 Feb 2024 18:16:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 262181
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1297
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame E020 30 KB
11 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D70Hx4rcYs2D-dGCXbcQxNZ0PjYq02NkqI_StqKvNWS1hwLV4AGqe46gIYvx5BWiTm5s0HNXI7cmGCiTdQXcnSByVTGTSe62uHM-rB_GBJ9QzB1wu7g9Fj9vrejovgdAYcg3R-23HM6O13-gMCA-Dq9pMHixiZifVO-jM8ixl2JTplJQk&cry=1&dbm_d=AKAmf-BG41mMpGZ_DnJ9z9yjCnr6YC7r0aTzNoa-DqXZ_2Dw30gGN-O1OrV6o-BHjEfEawNGwnZrkHvcplBi2mKB_ibzd2ffnlIrBDOOB7d1TJPQE1wuL6gUCwgyCW4Z-j2uIk3L78oBoXfqiIi_icTEa4FhgY6OdQa704W99QW5nCfgvNCAC75I_QOArMlAP2ETKIxutt1nw7EmvyBeI8qwPUbzo5HDuTZAdoGTpBeuxxLZr6j1nFpLGwI3PehpCzymqn6b7yF2vIf0d6TL52VsIOifPsVAXSbqSB2mULZPv7e3TUKMcaJeOtLMiggxtxGdUCfmTswhXrwRLsHHBMe9Rdv45WrHJRfjQUEy9yYhZZAdS8igWLy6lDFygw_PA3q7bJv_NxDXf4IMtUJn12mXSsbuavt1vZWaPxm8k-xwfKcIpIs38AKzXuPwZbd-JBGRkONXn5fDqnBmfGbvv2nhMhlytIqirEpHbKBwwSRUmE4iTUaiJJRbmPWKnV6CUjU7cIV-htPdbt0Mdm_i21rzYmZfUwvFZbDiWxz3ao20M5GAb1Z5LXVf-2kX9celXsMLE9a0_vwBJS-MJasuqbdkBEL_4Ge7JrRT6F6WwNsiIWBVlonwyd8ezkiBRKxfjjA-FarvhjBXwghYiew62tBYQZM-umvr6PZZj9zXVKDIrxd0U8md0HbPfoQTxnkcYRTsalbe4iVWdILJxlfhWpIIJ359fbMCvuuZebdcKOHscT4XjKjpFg7fZDsOf0PcGxXCmB-N4-2uuxsUfllzRm144iMxDfhtHzPlszchMhJ8JXcVyLs5dVUkstyXYF4Y1gZbBMKm9-_HU8gOHJ78vPDdwuUbEE91nibuWBcYi43pgFlSXL9ttcXFnSr70tsb4hABWTNs7J-iYE_P7q6i2GnOxZDwocCOqMSMwmZkQ4BXymYZv7wWQfrcMXHtHEViJvJgTPPZDLsFv8kaJ4-5D7vBPqea5WC3_oF8NOpE_6ydb5yoF7Gf8_Pt0HS_i8DKPft2kpCoq9u3of2AKSNO1An8M_vjvYYC_N8BUUAjVHgCyT2TbTQN1f3sKJK_oGsCo5PbEgvQqBfHv9y-Prfmu5IfZza9VUd_SzNezAbR5JTszyzZUfU7t81tPeToyY3LVGY1BgTW-hbf0Ja02t_9zowC0HHJq4IT2iUXpMkGBKfOcQiiYFPK_-EMH1TxICpz-LHkVaBbzno0ivKTYUi-4lQxpVoxONPHvE8koKiBrcxFYY2p0_7jMcgJvHt8NvLfLoUWgVS9hbJVVDjXvxuCp-b7TObnfnDWZ3NGXz3ah-9fPI_CIoaNNRcyTlKCVhlgE_GjiUbwqGIjzSTW_2UUci1AeDlX3EiN9_JvhQ2reWEUMNTKh_aDQtJ1-9yJkoBvZyYQKy-K8YuxybqFqzXvBQXpAiPBEf7z6RMRzNaj_fsm9YbfbudLDDVVdt3-mRodZ656tCoK0K7AxUMg7lschYCsmjscR8G1-UB8KwAlc_sFdvQsYgHraPyhiI0a2Mc-0DYNO92mvDot8klzr2vByTpYSt27qx01i_7-HvS1j_F0KwXeuCZEIBhRbGyUQn436aBDC-DsGeMqXep-WFOap6THg4bA907oRhcWXQbb53ZCzZuz3W79jK3JgQO_q2_qJMDuTWviUpfyD3KeV1VPn0x4etKV8r6tJI8veHyS2ree-AU7WE60p_HVvCl5GNCgenjNt-_Trl0W5O1iPyPaHIFN0oyO-6_X9AgUfNJA4K_12GbS6ED-eqyWi1iw8HuwtlNq-jUwhXTTeSBfnLKQ6W_l7tgEXwFKGZhyt11Zx0KFcceTBJ2Uxuv-y0ypX174sLJ6bYme3P5hjeeoQ1Ikrzwa5MWZBZJZsk5kx4N1BWIzFuHrIdpSqSF0oHq6VWT03QnGHiJX_i7eqUePinvSiGvwPmS20bWGaLZn9aCuy9tcf5de4tusDC6awftAipfxay6rdd7BXgaWbk5h-7Rfoo44P8brYmStGKxttZfaAnTG4iHOw87-F21L3HDyG11pjH_iAIa3e0AFMdfPzU_VgsYnn5X-K4lNwCLyzWoT4pcV8d5V2P6bGC-ob4JFqr63ISS1mZRgSgbUD2s1gA-9agPFRA5JqINZpZS3TBxFSqCD4fsKm7biawkVh6ecEuyovI-3CyJJv4_86LX8kF2j9IJR3OyH5Fmim9fL0pSjFQnqNC__u3of3vsXxgdr7b3DaFhLrXTKD11_Uua0kyOIYVONpB3X8-X91d_3gr5XP0BkiT78t36-2l74SlBwo8BLn59QT189pzpH5MVueSAlhDmgPDe8g1e41KUFF-31XxrS3dru3rtbIEGcqZUOIcOJ-zEIdcPfwp6yJs9zrI7BBu52eWe1mxqSTo0EzhOiZIsGmKb6z_ghtGJNDqggFuNf1EsNF21tWqTu2cJZTozt8S7Hnd3c-cChPbxNEWzw_v0fxrhxFgp8WK46wY048s45JbLtp6aF9gLgAn5O85TTR2BPjFqTz9mkFe5HtGJd2_W2hoJ3ooq8o5TGlu4OS3ioQnpkRmxphnFbBeKEkX18ywmIfsi0Oujxx7u3Yc0aexcUhAcIW4ri3StgkEG6eEmwQgEZVnBuZNWq9r5ijsHEdLbK922EKiKbi9-we_CUn9MvDrLs3O6hpcM5R5YblwYcdsjWlwaW7IwmQnZIwxxXRRC7VmQYG-dnGN5QFR2YAZniMrq-Eu1mFfjmX7n2NgsWQHSf9P6imzMVjvlWcJ_RTZUSp49vuaTkVettGYCj_DbbZkGgv6R8iH2-xdvtt8o1sb1RQumEg3MengCmHFjTpm9_CBob_MtrMZzIvrg4GRbjPJ4CFmv7ei2itfZLQWUNXtBJ3114YswT6pTPvvgVAHG69m26YJXJBa0Fzob89e-wT96ryjxNtGY_oRI21MgH35dxW0TeJArGzOMfVplXCV-mPelJ8hRhyf7m0lpxL-HB-NISPYjDEYfNU6AjU6Eep4MHQyh4DYmPfDB-ArCB2rkoEwjKOXFcq7dHcDP63iBo1etgGGrQeR8xlGyolRuqSoWqQTYNlzwnVT1jQ5rdePK6GnOKF5WKOTewsxxOZNM-Gpl15JBxljyDmCOjCJr4WIl_m0e_3movk-Ar7HDf_UO2NUIjJ2y_YMKcWoQkhEnccWPJ7wXiNlXVaba_qvBdl22J_q6PegJyh2w_EtlrQ-sC5yTEeeqx9GfOz4BKM15qxk5tfFrTnDLBN4TP4oYXpRubYr3sXHDbadUjk55_H8K-Hi3idWnaXqgvOh1sHAn6t4F_yGXu9OynYf-V5CHQt5PVFQvTlqmg5VS3TXg4wQ_8DJFUKzKPMkGELmtTHyncOg9crYpW8l0AZJqZRQXibJBfTqZsK4hPZxPbM1n_BMBXAmj8zFo3RhReVjylxGvKeB-4P9aBekSdMdIt4bfFm6IwgQ3NAcm7PdRKHtAYG9VtCza-qePlWXD0ZOIw5jbbaJ85IUsWnRvcjPS4QiUZAbZ9jsGjxAfhY-o1HJEMVjxkSPBX4GT_3OqyH4CAloy9OOkpCVVzy4Bz3iiyc1ENAvGS2me7sSwrATuegfQjvuKTQQyuulUmn9E5P-Y53BWdtjoQDWn5rKV1qugS21a-U4Fit-GiXb9noAV7EkkSZaR253i-jxi3rPzoJ4F0Joi_AX3IQk0z5WHXR-OV1Uk7qE0Zqh31NtJ8G6HrypxAQ835dD8IRo3gXVao6O4A7W4EhR84rilD_qHxttbQ3fFzPonf1Nlwx3b25aySqhgRGA3d9U9dmDFdH7chsOVjACICcSC_t4rNBnmAklIZmrPC-V3oIv1cGckBJ-ArqhUz73zGA5xGOQhIbwsiClv1Gue1Te328scMjwIT9I3aDWtY4XdLBmXtAkPUwhOokUs4NK75DygLgl81gv6Kis2-inpIeIffUEhvNw5aFzl2rPy2XxGjKlqYC_vdnucCE-kqXY7WyHwPyycOpwjDUP75ccodrgfHS9wVdmQ3KAa5DYUlBWZ8kJNKio52JrZEFeE8yxUu77VcIXtWbStG-qod4RiSSIfC_spH_dc3BIBuvUvmhZZ-d5r57cNKPFNIucZ9DSQElPYpRbX9dkv3EWjue-auclEmbJyv4LruFndDH4rHmLcySyR8b76jOq9c0hirGOHaCzkwFmDgMYpf3NZGACfkdwjNgZ0ThfI&cid=CAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=14884105883518288000&adk=943508964&idt=85&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame E020 41 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTU0NTI1NQogIHNlcnZlcl9pcDogMTM1Mzg5NTAyCiAgcHJvY2Vzc19pZDogMTI1OTI4ODA0Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame E020 0
22 B 42ms
42ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTU0NTI1NQogIHNlcnZlcl9pcDogMTM1Mzg5NTAyCiAgcHJvY2Vzc19pZDogMTI1OTI4ODA0Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNTE2Nzc3NDI4OTQ4OTMyMjQ3NgpkZWJ1Z19rZXk6IDMwMjc4NTIzMzUyNjA5NDk0NTgKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"3027852335260949458","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"15167774289489322476"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame A70C 59 KB
14 KB 186ms
35ms Script
application/javascript 54.171.253.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CYmoknduH1_ihCQh2Y7Cuxw5Xf7IIsUSuDF0Chr91A5zdNOvMAMkD_d7-IsJhZnqeIKZJHfwhlnbMwOmHpMT-Fz9dD48Tw4iYwBmZKpBt9JQCf2vSNqssFtwpN5G_ahzZ4S6_yR5-AT_n82wXykawg3LdJwy0P342QLBOPoiaSpK8dDYqJMj7uvVc1Fpfq59IyvPkU62ZTyeIPjPZ_rPaQ4j3Fq3U7ZW3aikOk8Ma081MaANE&dbm_d=AKAmf-D_j_YxPsT8OzQn0-VDYtTojz_Vym-dvghxUpwrCCZSUo9OHaJAKUsKBpmLfwG832gvbrDDEidcavDoZC-83nkDu_ODvO955midL3TstdqWBzu36naB1sne326khw7oy5H8zKSQ_iMtJrOpOGe67HA7c2MZSt2dvbAqp2aXFJLneSFVPsvPAWyAE8GC3G0S_cRag2MxyHNd6xJqWYwtBJJReayjFFY1y48fMkbweGDQTnWIcmcS9o4rS6jKiBvO3Dk1FCju4gCTKwZ2V3n6eKt96qdvL98ufpzeZ82addXQeLBHIYkAuKTpEl7IaGFPbKahQcOs4NX8jGt6GqTfJT98I15TG6KBktpK400mOQjFi3-k2bPLwIlS9UrAbIK_RYd0HECzqv-O4M7kn9BJlU1R61k_k8FykHVC-XwIUiVg9MwJVWj_DGfbSQqb53n7VOAv59kvpQbUAjdZH29fd9zDa-3bGNdZUxJMcZUhxXRsR9aTiOM6-CbipdL1g35k9xBxUeW2CNFRh9xsFwdmw3xO01p8wOE6BoaLlECwvHI1h0J8G6jKeFzvlJUX-o9i96tmm9Gne5JLn4cdxJ2NWPfR5a9Yp8E08SP6YgIvnM8WrNTSVLFSZZhv8zOfsakr12aP_ZoY_a-InrfWN6jWWvjdfPEa00ZgxIsfdmsVRRHDvR9TIv1SWWX2aQw3ZpRhjUX_NF0iKYMmdU4Ppp9FNEcC1cMyIa99ObO9PI1vHS7Q0utTk-_upmPXTeN5DzxEjJRTQaQbRNknE7ey-NiXGGskQAnGaiGU7vDuaWnYLQcKwTxR-gGBbpNfe5MhASw05GLHaeUG3K4BDvmjpJmKu1tZ5Nkf5Osk8Pim2hH8yk8gCY-lOJPsf6ZAeppkXpo3JZzAm93Sp_-XkiHrx-eLf5IMN8rpOEyuqvN8ss_EDdOcLIl9d7kwmj3dAH_LCcUKsE69Lwbdc8v7P8h3isfoEz1F7XNjToDkPFS2yLxd5lou9dTTQ4bItQaeqUFcnloG8FSGKTzSwIx6cjgA7nIFSZnlMYAKxO4GNaLE-zrCcDgLiCVaAb4TGrnq8O3cFJB2zfqz1FPM1lXPpIR8w2OpD_vZuQVTAzC4JhstVEUZH-SCR5K-GBXSfVwHb4DpgRk_QfJDe88Vcukk2GXoHU91S91GqEZJlZsYgDmlUq77nvT91SNUFsoHqShwWNmeqWHYfUmnRlu35QcZcjw4JbHk9cp20mzmY_d4P58M-RN2K2vDVyDT3si-qyC8hyFd0X0SrQhtzcT7oSm-qWg-p4kNghc0hP2jmbKyxZ9xIWT3r14_QiPN_jo15p2X_i5L0O5_QN631pI06hHa0o9Rc4wgiqzYB-suGkP2963QfPbjR5jvDrCWJcFEI2XfFqAjb_jkk8_ixaLKJT732jm6AdznmVoeYUy49sfhR9t0DuSDGmYE6BuJzG0hlC3w4OblMckFcyE1yQqUwG2K-NcPy_HZgn406-F-DXECpMuXhzMqX2ouPGdjlPJ6O9ICcy94bc420aO0ilu0-uoZdYp3TpiLxD-ni7dMnUvKcs1cozs49pjO98ikReuRSNEt2QrZwwsIgEbBHWm2ucMm3PmJ6Ey5zJF8GB_-MHKfAtjhySe6yJOi8Nw_CafPQUr9W-wd9eYPtLXbOqyqOf4YO1Cpr519rjaMLtQBg45vN3uVKpCU1ruUyERDsMHUcXTBv7RAE-x_eNR6bxw8mDzj0JbqBc6QzeSFC1sWfflUBDXx6gkwIDJaIO6klayxj3yvMjq6834TOWSIf5zCzngyBxXbxiUyhwmlJjKidjlAmcl73oeTsX76db13hIBY8klgGhjLRLrm0hmiDj2uPJzkHonrV_V42GPNer6B94muEJtriKb-3lZvguPddOB0dOxXN59-HK97E9O2BXLyYiPCLlRnbv6r1puWd7Ij4ZKuxwgpUw2bOLbE1z-g8WY-aSIc5LQ7uCAcHvZNXdBogVnqdckiI2nsFl78EYlSKEV74jvnshNgwa34YrxKa9Evq3DpxqmMMXIdGWtH9zdWCMB4liwkxsyV4CjXfFEEKZhPdJ2cPspguJpTVtoZot8yhNFYNSR-Hb23VcQTALZ7t9tMWk6GVjLWobK6Z54ItjCaosV-SzaHl73RvTgwa3SWr45oAoaGzsdSzB1zMWpnlcyep5UDMJmM-O3peoVqaUTg5TRnDodIFi84g55mQopDhpGwYXrISPjL9mjpzZqrqqfDsfn_q9fj8bv_gvsqU0FlOXMlIa7FUmhh5iblwO4-fbdKyAbUemVJMajvB4XA66CKCxXTqGzlTDpN_gdHDACc8QS2-pl4v-_Q4eAseHr4YbcVMVx5x73ggl-W3qB9Tb6UplGHsi78GLyJc1MuoH8Ix3nv3m9SE0WyQ843wD5WoAgBF3rKl7Ovcnnu_6o75bH85GbBr_b7TQJ50Ek8yjODvbR9nPQNCqhEbi06hGlkjYmAh_hf1n79gM4JB-EqY4lzXpwComDC7TZN9xa3xZeh-c-iP29E7Pnxi8FaZmQmuZ0MMTeE_RfuDtqxz1az_djCJ6TdXB-eWwQvI4E2giapVoIldKMW1AJUco9JP8gKjnbg8JTy2iar_EWk4nyzeP4F-tYBqBOEktHJvjKg62YVQoAHuOwr6IoS9WQ1_Si82Ii2Rlawa9xdGtMIE-eok6FAYZ1AJ_8nG98jJnYfgk5zvmbJMDhWE4BzNtKTCDTOxyAbyC6upCUNdS6eW8yvE8VGdwzQDM0oy0omawUzi77xxbJW_B07splwFQWZhr76MQacSkkHZTcKRW5opm9fTsI4W43FFXrhxQF-jNtye5IeULiJ9S8cOWbotQHIJxzPXxMf_GS1T_xr9l2BZ0SUwoMEShqrE7haQYD_H3rtefCYWnrbslK1bw9vJaiAPF9YnE4Erb7XlPOvNlnvNJ2Xv0J-YJVmzwh_MYA2JaQH_67qJjITViQnJE-aDYCFQomY_FVleaP0Rywi-nKCwrOg60e7-ouduPz_PhL9kNxLJVdtU_87bR8kRkFpO5C2qbNIu-ACx1lUZ_EcLd_XmWVuoqsRL0lMFt9ExzOs3Sbtj3iio7AhGZbHs1YcRc5kxChJfh9_D3yX0BB_Psdo-cu97XXGspLF17XYl5Fhoh2aJhHynjjuaw0_0x6aVTmOSdCYQLA9nUd4pJ6Ptsg-TlKzBhltHAQFRSP_Kw-4NYxB34J4PweQFg7JgNHGA87qjoCnMs0QjXvXEPFsWTWYDXMtw6aFfzOxnbu7IJxsxgOwbCWNaZYKYJ5laBiAaIDHDtc6rexB04zOykQmTfTHXk51Q3XkWAFMpf25BYMtsIbA_6_k-IfEG6nZGbWYt_R0438UpDBCaMulzKyl0wgDkn4Jq9p2gZJolCU3NWv1iUcunxorGv6EpC9UcgHl7adziBwUTs1kLVyxrPOxQXh79irbvsBm4F_KPGektSDv6dP7k0s0ca3-VEreld5ZYHMF3Vdeu4SvxfJgdJAKUbQ8w0iR9jZlhuB2WQR6BGY0Vevh6x23ZYgYOZk_3gyGEm8SO1xPpw0csFjOe4AQXpAM4aIdRsNcTr4UlmTfcGol3WqQOn7euGVPIf0htWCVhAHFjx8yB0kvSV0jqIU26VuLLQv101FpqSBoZqyhI-0DUO1X0fTZ4WT7j4k9BtesI2qjhIgV4N249yHvWpDa0Vb5zWKPDpbhfT4ynqZevgFSzWhzbDB-alKCvo30YukVgvooikLVRQkcKL3-CG5vSfhadV_wBQL8NpoSNqhkYI4PsIH5g2K4duoZ4nEfhn_cbeQCVTsdUpYoGaNVZubPfGV7SLj33-Uz5xIWxVrLar7i7i9uYK2jhsK-GrgIAfH6titzf1sYDSzayOnJcatNF9nFfm1tNEybLZpeuco1Wgc_5SFo_CpmbgFyWE0d4APxaKXwTeaAu0p0UHvT0dnMK6NbcM2oDMByR74eaq9LV-HNMyVkORzJQCuta9LnDUbcjoxZAVNMXIIezpoIQE_xuWFrOfDRPk099ed-yS-F5cj4bfWugQ&cid=CAQSTwAvHhf_cW0OINwgf5afibv62M78K_F29uwYVk1gvIz80oi7_YwD-_JA-P_T8TFs9v9PkjureZZu7VNvGqf5ZMGBSFWsVPi0MeZbd42tMScYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=6806143219634768000&adk=1964084971&idt=54&cac=0&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.253.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-253-204.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: c008981d65e853ec2bc5e08b8e85321a284c8565f23479e2f033f2c93d919ffa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame A70C 54 KB
54 KB 11ms
11ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CYmoknduH1_ihCQh2Y7Cuxw5Xf7IIsUSuDF0Chr91A5zdNOvMAMkD_d7-IsJhZnqeIKZJHfwhlnbMwOmHpMT-Fz9dD48Tw4iYwBmZKpBt9JQCf2vSNqssFtwpN5G_ahzZ4S6_yR5-AT_n82wXykawg3LdJwy0P342QLBOPoiaSpK8dDYqJMj7uvVc1Fpfq59IyvPkU62ZTyeIPjPZ_rPaQ4j3Fq3U7ZW3aikOk8Ma081MaANE&dbm_d=AKAmf-D_j_YxPsT8OzQn0-VDYtTojz_Vym-dvghxUpwrCCZSUo9OHaJAKUsKBpmLfwG832gvbrDDEidcavDoZC-83nkDu_ODvO955midL3TstdqWBzu36naB1sne326khw7oy5H8zKSQ_iMtJrOpOGe67HA7c2MZSt2dvbAqp2aXFJLneSFVPsvPAWyAE8GC3G0S_cRag2MxyHNd6xJqWYwtBJJReayjFFY1y48fMkbweGDQTnWIcmcS9o4rS6jKiBvO3Dk1FCju4gCTKwZ2V3n6eKt96qdvL98ufpzeZ82addXQeLBHIYkAuKTpEl7IaGFPbKahQcOs4NX8jGt6GqTfJT98I15TG6KBktpK400mOQjFi3-k2bPLwIlS9UrAbIK_RYd0HECzqv-O4M7kn9BJlU1R61k_k8FykHVC-XwIUiVg9MwJVWj_DGfbSQqb53n7VOAv59kvpQbUAjdZH29fd9zDa-3bGNdZUxJMcZUhxXRsR9aTiOM6-CbipdL1g35k9xBxUeW2CNFRh9xsFwdmw3xO01p8wOE6BoaLlECwvHI1h0J8G6jKeFzvlJUX-o9i96tmm9Gne5JLn4cdxJ2NWPfR5a9Yp8E08SP6YgIvnM8WrNTSVLFSZZhv8zOfsakr12aP_ZoY_a-InrfWN6jWWvjdfPEa00ZgxIsfdmsVRRHDvR9TIv1SWWX2aQw3ZpRhjUX_NF0iKYMmdU4Ppp9FNEcC1cMyIa99ObO9PI1vHS7Q0utTk-_upmPXTeN5DzxEjJRTQaQbRNknE7ey-NiXGGskQAnGaiGU7vDuaWnYLQcKwTxR-gGBbpNfe5MhASw05GLHaeUG3K4BDvmjpJmKu1tZ5Nkf5Osk8Pim2hH8yk8gCY-lOJPsf6ZAeppkXpo3JZzAm93Sp_-XkiHrx-eLf5IMN8rpOEyuqvN8ss_EDdOcLIl9d7kwmj3dAH_LCcUKsE69Lwbdc8v7P8h3isfoEz1F7XNjToDkPFS2yLxd5lou9dTTQ4bItQaeqUFcnloG8FSGKTzSwIx6cjgA7nIFSZnlMYAKxO4GNaLE-zrCcDgLiCVaAb4TGrnq8O3cFJB2zfqz1FPM1lXPpIR8w2OpD_vZuQVTAzC4JhstVEUZH-SCR5K-GBXSfVwHb4DpgRk_QfJDe88Vcukk2GXoHU91S91GqEZJlZsYgDmlUq77nvT91SNUFsoHqShwWNmeqWHYfUmnRlu35QcZcjw4JbHk9cp20mzmY_d4P58M-RN2K2vDVyDT3si-qyC8hyFd0X0SrQhtzcT7oSm-qWg-p4kNghc0hP2jmbKyxZ9xIWT3r14_QiPN_jo15p2X_i5L0O5_QN631pI06hHa0o9Rc4wgiqzYB-suGkP2963QfPbjR5jvDrCWJcFEI2XfFqAjb_jkk8_ixaLKJT732jm6AdznmVoeYUy49sfhR9t0DuSDGmYE6BuJzG0hlC3w4OblMckFcyE1yQqUwG2K-NcPy_HZgn406-F-DXECpMuXhzMqX2ouPGdjlPJ6O9ICcy94bc420aO0ilu0-uoZdYp3TpiLxD-ni7dMnUvKcs1cozs49pjO98ikReuRSNEt2QrZwwsIgEbBHWm2ucMm3PmJ6Ey5zJF8GB_-MHKfAtjhySe6yJOi8Nw_CafPQUr9W-wd9eYPtLXbOqyqOf4YO1Cpr519rjaMLtQBg45vN3uVKpCU1ruUyERDsMHUcXTBv7RAE-x_eNR6bxw8mDzj0JbqBc6QzeSFC1sWfflUBDXx6gkwIDJaIO6klayxj3yvMjq6834TOWSIf5zCzngyBxXbxiUyhwmlJjKidjlAmcl73oeTsX76db13hIBY8klgGhjLRLrm0hmiDj2uPJzkHonrV_V42GPNer6B94muEJtriKb-3lZvguPddOB0dOxXN59-HK97E9O2BXLyYiPCLlRnbv6r1puWd7Ij4ZKuxwgpUw2bOLbE1z-g8WY-aSIc5LQ7uCAcHvZNXdBogVnqdckiI2nsFl78EYlSKEV74jvnshNgwa34YrxKa9Evq3DpxqmMMXIdGWtH9zdWCMB4liwkxsyV4CjXfFEEKZhPdJ2cPspguJpTVtoZot8yhNFYNSR-Hb23VcQTALZ7t9tMWk6GVjLWobK6Z54ItjCaosV-SzaHl73RvTgwa3SWr45oAoaGzsdSzB1zMWpnlcyep5UDMJmM-O3peoVqaUTg5TRnDodIFi84g55mQopDhpGwYXrISPjL9mjpzZqrqqfDsfn_q9fj8bv_gvsqU0FlOXMlIa7FUmhh5iblwO4-fbdKyAbUemVJMajvB4XA66CKCxXTqGzlTDpN_gdHDACc8QS2-pl4v-_Q4eAseHr4YbcVMVx5x73ggl-W3qB9Tb6UplGHsi78GLyJc1MuoH8Ix3nv3m9SE0WyQ843wD5WoAgBF3rKl7Ovcnnu_6o75bH85GbBr_b7TQJ50Ek8yjODvbR9nPQNCqhEbi06hGlkjYmAh_hf1n79gM4JB-EqY4lzXpwComDC7TZN9xa3xZeh-c-iP29E7Pnxi8FaZmQmuZ0MMTeE_RfuDtqxz1az_djCJ6TdXB-eWwQvI4E2giapVoIldKMW1AJUco9JP8gKjnbg8JTy2iar_EWk4nyzeP4F-tYBqBOEktHJvjKg62YVQoAHuOwr6IoS9WQ1_Si82Ii2Rlawa9xdGtMIE-eok6FAYZ1AJ_8nG98jJnYfgk5zvmbJMDhWE4BzNtKTCDTOxyAbyC6upCUNdS6eW8yvE8VGdwzQDM0oy0omawUzi77xxbJW_B07splwFQWZhr76MQacSkkHZTcKRW5opm9fTsI4W43FFXrhxQF-jNtye5IeULiJ9S8cOWbotQHIJxzPXxMf_GS1T_xr9l2BZ0SUwoMEShqrE7haQYD_H3rtefCYWnrbslK1bw9vJaiAPF9YnE4Erb7XlPOvNlnvNJ2Xv0J-YJVmzwh_MYA2JaQH_67qJjITViQnJE-aDYCFQomY_FVleaP0Rywi-nKCwrOg60e7-ouduPz_PhL9kNxLJVdtU_87bR8kRkFpO5C2qbNIu-ACx1lUZ_EcLd_XmWVuoqsRL0lMFt9ExzOs3Sbtj3iio7AhGZbHs1YcRc5kxChJfh9_D3yX0BB_Psdo-cu97XXGspLF17XYl5Fhoh2aJhHynjjuaw0_0x6aVTmOSdCYQLA9nUd4pJ6Ptsg-TlKzBhltHAQFRSP_Kw-4NYxB34J4PweQFg7JgNHGA87qjoCnMs0QjXvXEPFsWTWYDXMtw6aFfzOxnbu7IJxsxgOwbCWNaZYKYJ5laBiAaIDHDtc6rexB04zOykQmTfTHXk51Q3XkWAFMpf25BYMtsIbA_6_k-IfEG6nZGbWYt_R0438UpDBCaMulzKyl0wgDkn4Jq9p2gZJolCU3NWv1iUcunxorGv6EpC9UcgHl7adziBwUTs1kLVyxrPOxQXh79irbvsBm4F_KPGektSDv6dP7k0s0ca3-VEreld5ZYHMF3Vdeu4SvxfJgdJAKUbQ8w0iR9jZlhuB2WQR6BGY0Vevh6x23ZYgYOZk_3gyGEm8SO1xPpw0csFjOe4AQXpAM4aIdRsNcTr4UlmTfcGol3WqQOn7euGVPIf0htWCVhAHFjx8yB0kvSV0jqIU26VuLLQv101FpqSBoZqyhI-0DUO1X0fTZ4WT7j4k9BtesI2qjhIgV4N249yHvWpDa0Vb5zWKPDpbhfT4ynqZevgFSzWhzbDB-alKCvo30YukVgvooikLVRQkcKL3-CG5vSfhadV_wBQL8NpoSNqhkYI4PsIH5g2K4duoZ4nEfhn_cbeQCVTsdUpYoGaNVZubPfGV7SLj33-Uz5xIWxVrLar7i7i9uYK2jhsK-GrgIAfH6titzf1sYDSzayOnJcatNF9nFfm1tNEybLZpeuco1Wgc_5SFo_CpmbgFyWE0d4APxaKXwTeaAu0p0UHvT0dnMK6NbcM2oDMByR74eaq9LV-HNMyVkORzJQCuta9LnDUbcjoxZAVNMXIIezpoIQE_xuWFrOfDRPk099ed-yS-F5cj4bfWugQ&cid=CAQSTwAvHhf_cW0OINwgf5afibv62M78K_F29uwYVk1gvIz80oi7_YwD-_JA-P_T8TFs9v9PkjureZZu7VNvGqf5ZMGBSFWsVPi0MeZbd42tMScYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=6806143219634768000&adk=1964084971&idt=54&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 339663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame A70C 30 KB
11 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame A70C 12 KB
4 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9558
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:27 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A70C 0
0 52ms
51ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsufPkvFlNwCymm1XamEi0OFYurxo28igxBaUtR5r2IJ-MXJWzetF96rKhWB2GNPpg4eUaMlX54QKTS3-rjwSMNL9FKqj_CwKwnBKOg5Pmzls2BU2V1vY0YD3us6mzCYlr9-Rj_EV5Hk4beF3okPVG4g5iN6iwGHPsYhykhmQ5Ib2K1hdqp1ZR4z0o3yRQtKObRQYWOMPvsxc1wDxcm7Pcf13dOOPhaDQn8AUPvXv_sEHvf0feFAyPnfxTD2unSEa2ntQiOd0_Al9MxG9dNXoTvzS10102GRB9-WOH5flfQS8DU5uE260WYVuITtgphAc9xDOio4Jrdm8kliFXNKQwg0n-SNICaYYdR1faXG0xv800kqtH8LiS7l22jtR-C6EBow_N0zi8YWXkZk41XANqtEmNeXbgJmgbhEE-WR08hZBUiabBW70mb66YNwbhdUazXnX8nShtncq7rHbpQwImH9oW-ubDWuMqbUU1Km0ZRC9Uma7FKbs1OlJiE9GaZzLZx-2SfY6Tv4p1qNNzsX6YvYuLdTK5NZebXnrxOkFsclV9efuRVtGmFYyHfqZ82JDQ0ElrvmtpXKRkb6Uh8gVZGxjhkUnXCRmyeaaGt0p641vajLYiQStJnTmogjIeacW5sJxBFcU_C8FVPR6xUQA1NDHr8N0SggaVXzhrxvTEvZecj-3NnMMbazmBWa_jgWsBO2ZvvI_vkar2cQHQbB4wD6xKMvh4Oh15wfh5NAiDgPhE9qpbU48FR_urwL29x_8nGxfpusjqYQrc7d1hOXtppPtat6koK5WKcYDq0D3dycha2ZWmh2N0FmcWbvbp0bavXsrTHeoPIWcQf9Od2-ROwBBvKWkMe1m6tOxdumtDD9LS_t0tAfcp_8gK-24_TLMgz15SlqrgRqSOekA4kWL-tCwb1cWMjZ-FfUiBovdb_8Nma3hC96tX8HYM23gIhYZX11iI0Ge6w-JpRsRbE6QWDlOshrvqJQy25aSzUl5aQ3dbXIGkqNGAegia7Iqo9sNabuvJ1sMQ_LfCMjJ3YmV-1PcLahuBHQ__g_dntAF4-ny12cbbfM92TBW1QAQyKRUNCnrgFND3J0uQcuwwO9PN_golK4i4X87BjolBh9DFcL2WzNqxv5AQH9B34aSVBbUZls5LoQKL0Ym6JeWjDc41hL_wwVd1EeglDI_x2yKLL13ZgDf7Cn7djTYFSiYKJd_dtbF-IV9dWWNeFY5YZ_fMrBMl8F_c_fysnks8g6TRSof62EXR1ONMCi9Cd7DucjYeeZ1dVhB1V35iWkJiycDOwvC0jb2ccRfjfj9qQnO8X7grYctOK2QMnosCio9QOxKYOwu-8eqenm0VmH-Zsk8EC86DjYbsjjgs51DXwGRUECnDwAt-Y-JnITfsbgfU--BW5p02OfRs5HJIgIL2JflvyRgaNrCjXxdIqvHMsnSIEnpRL9ygI8Wdomz43vZLeHybCC1BGbRv8&sai=AMfl-YRwcfpGCd-MGb6nIX0gkGOFDcLr8nGPFUMAApghRpPcFQ5hJGeEZoZZ_sXNmmy59d6FX4vIX456tGkHMpWz_cHK-cBR01Ne5XTasX9cPdcaHGCGzh3afR5mn_sl7QqbWeWViNeqOYj-NtSJoKHy_dWUkMlalxkRl3EyayGJWqIzORrLbHoA8D_LVy6HFaE_38lGMay_xXyjR6d8YiCdJOj87e0zfgLJ42QOwZa3kXmjWVcik0nkGTkEDC5rqJ44rySak6QFQu6rkIdXCpY-5zhZpnZ0NYe2OsFWDxUgbQLiqBVWfFFGvNlM8W8sMO47eqYe&sig=Cg0ArKJSzNJ7x1gHgbtBEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240214.92754&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A70C 41 KB
14 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H/1.1 200
OK request.php Show response
hal900025.redintelligence.net/ Frame 3FA0 3 KB
2 KB 102ms
74ms Script
application/x-javascript 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=c48e9e436a&subid=&uid=a4faaea9ca475e41&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2283732214845&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344799108&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 46d2e41131612f386f07c55f43ee1b3d0b617b2342e569c5bb62727ecb48058b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 90620400174352904444554012602025
Connection: close
Content-Length: 1122
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C0AC 38 KB
13 KB 9ms
9ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame E020 11 KB
4 KB 122ms
9ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344849148&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbrGvCLLPZfzpM7fBs8IPz_qr4AKm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NxcVBTW2gjvJHPdGSHOcahxDRKe5kVxJJPdOv-UvlVyjFyck-VrBIWQikiKrkP8f_p4wKxDEV7nkucTRHWVuGkbDqiBm2b2qleSMtkv2Z1Qi7KRjizyAhB9eE3vsSkPy-aLIRwlpEUPtT1ixkLn2d91ElNlR7ejsRPt_Z5Yiy9umJoxiyr3HnJzDwYWZ2F_r4rt0Ef0lrDw8vYficqTCg-tqFsfTEI03JPMwE5FhCLyO-ihMJqviMeG2TbYTv00kzLVp-EKNhpBp3pL2TfMU7UpzIoyGQ5mx_SxEVqrtNHXDOcwQDRC2CVGPNIHIZfUDki0HstGToqlq4FNc-aRTX5y4WK_ntjq8hSKbtI_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljUh9byxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB%26sig%3DAOD64_3vyHgHUeCmCVzu8cieJ-ARSbH_hA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Bz8kJ3p-I6nwpq4GpG1ANvCn3BLx9-9x8gHP12dcaEbmXUDYZucFPvITjqQ1NYv6Ek2aTrQb7qYCxB8l75cB8M0YhonL6KEGjZOu7n0gC8A6SjzipPjY5hk9sehZCL9eTBMw6YnkMxteZfVMJ9Os-hhFtYKq4Xr63QBNoNtMY6XMueH-s%26cry%3D1%26dbm_d%3DAKAmf-BDgNglQFpcyHOPjssL0m2pJGOyG6c-7KortzAc3auDPI0WwY9VgtLum4g66U-ciZE42KPQhUcHiXFMYtI4LKMfLs7VLeTtVn_VLRwdt8j8s-8JYICxRD_JIsmJ-4HoX0-b2G7zKY8c0JiCfyKOzaCG1zjTKAusciAhcennR4zeVcht5ZYOZgi_x3YcdHCgLkJJGQeh_ONywGRyQ_3ZkTU9-lQEo3phjd_GQJ5Bn3XLseIAfdo-2bPLWzgYJRFNjFkjYGSoRQxVykEbf6X4WZ8spGiHkdFm7dBLhKeFFDIB8lT3SiWJSeyi1A8FVKfQmuFKYJUFomA5WXzhhoOoSnbJ7xrOuv3pncKUK7mKBS8uCTPhnRVPLjNDkWrBV7jl2a85GPxZXt06t8ZpsuRNFVX5JhzuZOMMbGSw6Bz0NrxfbQl8LaliZJ_4egL36XV_D8FZN9Y9VCt_WyvuFSkRvwfK4Ypl9GiW0QAsDcdlXwv3ggEx6W5P3sCsWeieo5cV7M7BZXg9Nidk0ZUg-ppXl3JSijl6mLi0hiOk9-qP3IwEWcwjDZA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e67c54fc37b3e43990f87b2f8bed406cd8fd9d794d46b38346d62a78d1a534fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4204
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F489 38 KB
13 KB 8ms
8ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 565A 38 KB
13 KB 9ms
9ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A70C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7205e957bc1731cfe1feeb9fb5cad9270393f6ce42d8527de80847bd60b1652c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A70C 0
0 44ms
43ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsufPkvFlNwCymm1XamEi0OFYurxo28igxBaUtR5r2IJ-MXJWzetF96rKhWB2GNPpg4eUaMlX54QKTS3-rjwSMNL9FKqj_CwKwnBKOg5Pmzls2BU2V1vY0YD3us6mzCYlr9-Rj_EV5Hk4beF3okPVG4g5iN6iwGHPsYhykhmQ5Ib2K1hdqp1ZR4z0o3yRQtKObRQYWOMPvsxc1wDxcm7Pcf13dOOPhaDQn8AUPvXv_sEHvf0feFAyPnfxTD2unSEa2ntQiOd0_Al9MxG9dNXoTvzS10102GRB9-WOH5flfQS8DU5uE260WYVuITtgphAc9xDOio4Jrdm8kliFXNKQwg0n-SNICaYYdR1faXG0xv800kqtH8LiS7l22jtR-C6EBow_N0zi8YWXkZk41XANqtEmNeXbgJmgbhEE-WR08hZBUiabBW70mb66YNwbhdUazXnX8nShtncq7rHbpQwImH9oW-ubDWuMqbUU1Km0ZRC9Uma7FKbs1OlJiE9GaZzLZx-2SfY6Tv4p1qNNzsX6YvYuLdTK5NZebXnrxOkFsclV9efuRVtGmFYyHfqZ82JDQ0ElrvmtpXKRkb6Uh8gVZGxjhkUnXCRmyeaaGt0p641vajLYiQStJnTmogjIeacW5sJxBFcU_C8FVPR6xUQA1NDHr8N0SggaVXzhrxvTEvZecj-3NnMMbazmBWa_jgWsBO2ZvvI_vkar2cQHQbB4wD6xKMvh4Oh15wfh5NAiDgPhE9qpbU48FR_urwL29x_8nGxfpusjqYQrc7d1hOXtppPtat6koK5WKcYDq0D3dycha2ZWmh2N0FmcWbvbp0bavXsrTHeoPIWcQf9Od2-ROwBBvKWkMe1m6tOxdumtDD9LS_t0tAfcp_8gK-24_TLMgz15SlqrgRqSOekA4kWL-tCwb1cWMjZ-FfUiBovdb_8Nma3hC96tX8HYM23gIhYZX11iI0Ge6w-JpRsRbE6QWDlOshrvqJQy25aSzUl5aQ3dbXIGkqNGAegia7Iqo9sNabuvJ1sMQ_LfCMjJ3YmV-1PcLahuBHQ__g_dntAF4-ny12cbbfM92TBW1QAQyKRUNCnrgFND3J0uQcuwwO9PN_golK4i4X87BjolBh9DFcL2WzNqxv5AQH9B34aSVBbUZls5LoQKL0Ym6JeWjDc41hL_wwVd1EeglDI_x2yKLL13ZgDf7Cn7djTYFSiYKJd_dtbF-IV9dWWNeFY5YZ_fMrBMl8F_c_fysnks8g6TRSof62EXR1ONMCi9Cd7DucjYeeZ1dVhB1V35iWkJiycDOwvC0jb2ccRfjfj9qQnO8X7grYctOK2QMnosCio9QOxKYOwu-8eqenm0VmH-Zsk8EC86DjYbsjjgs51DXwGRUECnDwAt-Y-JnITfsbgfU--BW5p02OfRs5HJIgIL2JflvyRgaNrCjXxdIqvHMsnSIEnpRL9ygI8Wdomz43vZLeHybCC1BGbRv8&sai=AMfl-YRwcfpGCd-MGb6nIX0gkGOFDcLr8nGPFUMAApghRpPcFQ5hJGeEZoZZ_sXNmmy59d6FX4vIX456tGkHMpWz_cHK-cBR01Ne5XTasX9cPdcaHGCGzh3afR5mn_sl7QqbWeWViNeqOYj-NtSJoKHy_dWUkMlalxkRl3EyayGJWqIzORrLbHoA8D_LVy6HFaE_38lGMay_xXyjR6d8YiCdJOj87e0zfgLJ42QOwZa3kXmjWVcik0nkGTkEDC5rqJ44rySak6QFQu6rkIdXCpY-5zhZpnZ0NYe2OsFWDxUgbQLiqBVWfFFGvNlM8W8sMO47eqYe&sig=Cg0ArKJSzNJ7x1gHgbtBEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=53&vt=11&dtpt=52&dett=2&cstd=0&cisv=r20240214.92754&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A1E5
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

23ms
22ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Fri, 16 Feb 2024 19:05:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 19:05:45 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame BE1A 38 KB
13 KB 9ms
9ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame CFD9 30 KB
11 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcOWwCrU4lG2Fc9LnMdug6Ng5wSDGZ5N1Bo8q4bORxSLgslTebEw9a30gC2ul8kI3EdVY-bkJpIf5myEs5Aq73bicqO1q5nzPYdhRQkvGzby-WKq1QE29zNAEhwmYhb8J8hGSAn49sd3Eg9hER6bQA1enX4AcpvdpbuKVm_yjU4Kdby1I&cry=1&dbm_d=AKAmf-DfSsnxNhrSu5y-A3pTLNyn9Wwyx5CrwxMzcURhWF9J3lgnDk_mfL4ZUSQKfldcn_vE_tlDAenqPgFpEiwiVMESe05oGjg-HUPSSCLYSpzfnmDg0BPo2wS-j_fCbUw1eytSJ3ZqGGnFdtNHZBIcXSbtjJLMV6g8dhqvAH8USHZ4-Fe5uyHe2BAUlHwMSmiLfpEEIoLHiiTMcplfLxd0fSRxM5d0eIPgnk8ajL2OU5qFtHvQJ5u42PxALhQCOYsmaBVgO8KWHrThmkjjZeLI05LbxqFCrr_Pcqc5HRb8LprvQXG-9KOwCKS837LXtVuW6KXauRhdZtGtKDTeu9x6kKOclpoqlZtOjx2KINxmSXedPzFlxM7rE7iWTmFcKTiCPMpPxBJy4IbktHayF7FNgnPYzUtB2ey38qcoQzv0Ok9rmDkYb9MI4colYvmXYtPhfzrHIRpCDqdicMDxzyfhJuNo-gvLT_Ix6s1KwIE1iUzi6vh8-D63aaILSTfSbGzdwoGS0xFhUmfrNlcU3ojXZ_uIjm5V0Az1tmauCxCpjLY6aBw_7Z_dDW_GpK4HXXSVUsbJzKNuLPsA4bx30sU20RYx9DMSflN-saY2sFBA2dMo9HxjsvUzPEYkJieKpcHTc1bftga1xbTeVDUTKw9guDozu6xSp5Pm54Su4IsHmZSfnoaLBJPmP2hpjXZPLsBbmJW9gJjOSG7zXVieeyTugfx04PPxnoMxiFMLH0RdkXlphvrcdR9cNsWyf8GGYtMTG_PIDqFiToV1h1Mo5VNgipC9n9QJIMa4sbSC2UWn9oWIHG6dOS4GNv_JlpHSodwrVT0kQ9tG57XAYqIdhfaeAh3P_ltYzs2sU27k3bldaxZ4fjVQX6MBwxzLzi8g-z3JflcI8fw6XsGL9zblL-qT9NXqXJ7TByzqTKlnyHfxyKKMGOoXs-IwNdLRTFyRevdXD9ICb9kExQCSlzadylAswm5Ho1i-3ZLeQ76klmmvaa2ueII4flKD3uUJNgD3DQRwfFlChxH0cvuxBSsP2Em6P8VYmpppjCso3YWsrLUQpnWkUV676yiSHhRjDOYCI_Cssh_pV8b9GQybSTg-rRIDMXae5qMnRJ1BoXrC4tR2EExsC4U8n1MM97VHUEmTrn5Evm5_pNtaVXES-TbyepG0YqQ4rMNYxao7dMmSA8TH2rvFnnv9JCw8ZKmlKLBiZkwzm03XoPNO6PlYzziS6FgCtC4xxxQ1rdLxubKcbwTmbCHswQI4EczOUO4GBKzwc5ZwG3u5U0WY2YKyIPzyHzj3AlIlQKHHqTeDNQWjvCM71jiz8WAr1uUYC45CaTfW52qa3WhESa-pA5zZ7PNxMhUaggXhRmdydA7UbMYI4oIQSBNLJxonq_cvuLGg3kMpbcF6HT1g5srop1rWB7IUK91exet1BXVKRapnWFDpnC2Gu3Ade_ja1tPIWb0fqhD07rICMxJnQchrNTvtDL5BVeM-0lFwklR6pDoP2OQsVzVPC7Uqfgz83ZCh0i0DGmxNqGVI1nUnRWlX_nVYv8qB12vO0MD7z3687zXXsNje_np4jAluSxt-VrhQR2YwHdIzO23jifOmQZYRVV6sLN2b5YuSC58e4xcBq8ac8bsRzBjj_rHjHcvJsAh_HgZoWxZcIHmweF5etNT8CDOBJmLUbVsAEm3ABtG1SW0GLXHymCxD2kkpVeDJpl-4gHyeZqz1PKhfDxASdKc1Rz58mqiySFO0hJDhF9B9GNv2BcmAAbz5kzFRh5yo7_6Hhkc4zCybZOlL_2MV_Rl0uBbgI2UD-7-CSJnnOhRAzv7tYaK-UF-featndkg7mfgbG5zK48n2KYAH45pc4wcZsZgtJm3s7pSE2lo2pAKpa-jM4gfgRJy8Qh74qgxV9OEh4-8GYWOO4dF52Sq9GRA8xDRZWYZALdKur_Kn6JvUGY7QSL9trjlwFTkHdOft2XMtpxBOkZRZ-4oR4i8whAs5t2d9wRPHoPEPixB-xiYoXPWS4nTkhkAt-hUtTj_t3NTDtvYdO-CjN7zdfEUcqGpBgXRBWFeFGpIO48g2LrSCssX61oWxDXiflQlM-cquhlTNP5jnpbDF3wpPLHK_F25PupRnEd8R4asWh2X_2TrDw7HdQkXm41xmC91LmN1UCTWOiIe6kElFkP1dnWR1LDXgYLeYV__QfpjO_nTSnSe5hU5htkx0-w7bOM9twuOk1NW54g6oyU-nKiQ5etokLcl1dk5eZn82IDWIWZdrxLA-MBchkRXFN56Wa-yG4-nqnLROe4FiBNCqozCxwmseH-gkrGCyhiNttN_F4hQgQK95TVSWKGql54cMh1kRbkCnoXVx21KQPVIRcID61IOs9cr3l8hXfekEl9iK8yNm-vfWPCmciy1ePmmQ1IJ8vf8DHfw9Va4uikNrM-I3dI_vQdAuUG0tJBZWqkE0Z5nPCWWBciSXbmZoMyLe2Z_EPjSjJ-7HmNVWNq9ytbpf6nz8sWdhqg5-ACpTJLmqJ1dyewaF0_RhxTvwuDriOYFYqxNijA1GXfYJx2d_5Ihxbps8QhWp3pGZcvOX4TkeRCkvma51d3k-zpFTohhd1kEM70Uo8mtqsP_k0SLDBfAu-10fTx20ReUD3amuCsUL_GpxshIm64JbHektg2wtva1uKZXpVLiCtJhw2p7SbjqJGArviBnpXIqTZVwW2pbl2FKojZNHbe5epggHyvs7kFPBrWxEJIV-__qZI0eZxntAqXIibQwTjA5m9pzoPRJfF-h_7-vRdrZ-dGn-gQvKdxbJGcWtBkTeax2Ue4i8rVVyE7Ny7CnFp-trTI-1Jj_66KTTAlb3fJtZLf2vN849z4JQv9YYYaqQkfrMtI8MJu2FMhM5cr8-4aKBeXv5AxuMfDaNyhvoUfcsmtNPmO-MAMYP4QRJqTj7gRonHGTN531eHGaOG1Re3CXYgzUJ_b01R97aOo--zWv9VAYInA7S4MoZIVxYcwOGSQPMSh_6DLFYBUIySikNextrMQGjj1AqIG-m4HfeBRC8kOA7HwGs6m4Wde4x_ZPV55QVYTslEApcH1yBKlpsdCAaA_Of8p49q5gYmUVhMaRvTW9TkxffFED30PhNdwBB6qqEI15FE2U8So5qkxeLCQJYX7IHBU3O1YxCe-o6q0LNcHmy7ejBNKuy-KemWky1wl_l54iK2IWg2dbQRchAGD2Ksuqt3oBzMWqkc67DnFE6jhQvgGEmaXEtShM5xpQmRkqosiKLNf_oegdWErxYnw_ALQ6bLqCgRA0gMdNpTMGu_4-hY4l_avEao7zaXAcO-aS1aLBDe9uIMYo2to0Vddmuox-xaVuk1gQiTNWco5aGZbTi1SrnpiE_QG-U9TjtJn4kIlVGX0kExWK6TyAWVN-f_XTQvtWuQB7KkC5cFjDTla52accKsrhNzoqNSP6FBfQpmdPZIL-t_ghV-oa1Jmgn8pWojDY21hZebhRnNsfUkvjJcPtHGnvwZvjwW4MdgQyewKvW4hFTTK7Q0qIuldD2vqUE7as8WXMisgdiqqjSlpkCHvm88OI_mSdgml9gGXybLCh2tbD2ZEuHHthyY8APHkvy1G4Pjj8VC0oXlyAkei1cQ6tE92GUSv2qYiuVJCpKLT7b-75rnlz9GIitxreV5f-juXVOBEGm7LZCp_s0t9DTKgxy3d2KABWYqKY8mZbV-a2JDnp2rEgZkCD3D4a2IrFyUzyyvprSruo5zt0dABXtlbK5fsPYBQwcPUmSMjitcXBiJ54q1W3QC1Mj9kQVVO8MHbjPuT51Svy15c3Csqnzle1bHTojMvQIvRfWEqDKvUJBbiKQH4Y3fmATp8V2OPOt-Ly3eFvW_yEZIkU_UR6pg4ShSrNSm6DY6fmVQDSapNyKtvlyXwR4NRXYrsFIgYc6XlG5xDsByWGd85_y1Zhpn675f_zBGJJ7vNucHx2yvlt6A11y2DTGtT-Wr12QqruPD7D8jIQ3ekBbdmwv0QKKKVb4RN_fjVGg5-AAw8ZGLHQax-HmD1YaNQ3dKh36CIUp5lGl3RkPMOg8qvPEImd434XknZCvg0aDcooEPQ8XLO6_rIvxdzWuamOKvUG7RTaroZNOUP_fiWW-eOCgn66Hr9C88yiRD42WI6IAFyD_xRXoAVxJGrSPYqd-Wuw14hXxmoGiBBPQe6jQyCCsD_f3Pd95zUP7lRenAUw&cid=CAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=4511637126189661000&adk=1033480540&idt=169&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame CFD9 41 KB
14 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTY3NzM5NgogIHNlcnZlcl9pcDogMTM5Nzk1MDM2CiAgcHJvY2Vzc19pZDogMzIwNTE0MTg0OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame CFD9 0
22 B 43ms
43ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTY3NzM5NgogIHNlcnZlcl9pcDogMTM5Nzk1MDM2CiAgcHJvY2Vzc19pZDogMzIwNTE0MTg0OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxODM1MjQzMjExODcwMTAyNzcyNgpkZWJ1Z19rZXk6IDM4NDY5NzgzNzE0MjI0MDY1MzcKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"3846978371422406537","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"18352432118701027726"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame B32F 0
0 43ms
43ms Fetch
image/gif 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuN7a2Si9s1tpxcxpDrueaUOdcLS3LnPUUY9YXSDssHYqUSpFUAyFTL7er0kWKVB4uUwhuNv6UwK-BT_fyAgdRVzxy6hetN1GvTvI5eh_dnoYRmZbfBZ0ci3iANQXHzvcBtlm7-iPEIThCdqlSAmH3mBn4wAnm2al3mfiPj8FhVaCFFdnuLGDqSptB8Qfx3z8bTU6B1CdQqjEn_ZwgvajPkEt6RoXgC_HsK1-n1S_Z1H53Z_HC3UPzHE5RB3bbSmHovuCEPlh5GIbuXwWVymL8tDXSPEsP63VJAbVeGLkza0tIyh8bqaC3n0pSlPCp2N0MSyiGDxZJXW_sbbOF5sDg7MbJ3xxUUwdk10uc3mdt1S0EcLptcXQ2sZ7XwDaLuomSjLkuWMmD9qU8CMXU8RBVI3zElVJyUvMhCc0kgGJRkm5pJxtvvUGxaKoQZXFdUMBZfjhmheOXlWh7Q6htxS1U3Rmr52w79GfP60_44OlnOYupB2PNa_iI_uBymNUncQcEOk_ISabb56tmu5PnTc4QTGtkvkHpEJMntyfBhYShZkfkXTw-8BGt0Gb-03xl7-njUbbQjb0PcznvI3Z05B_uwWaW62paPz37j-R6ABckfQlfnnWbr-B4xNcSVxD1RJ3TWO05uYljc0guOZuuFpqJ1AXjr4U4AdYFyqxjxOUJIAOEVMuifJx5M3eQ573zODUE44O7yzg5wuptj64TKcmX221iQpa-WDpmdlAN06ce9T-DKX3kqDVZdzutSUVtbhxBKZjWdZHHdHXQ4Oz5LfST5o4rF-UKDroNUiW4lXmZ0fL9VhvSkm5zK_n8z4xKLIfluuCuO_U2ixfisLqStRjbXd9AS0ini4dgFcfbIy_lhYNNSfnVqabPqXpprCf1kwtas1E_IYJLwF0ZXFQ0DomRCu0JSOz2MnWq9labFOwebcSyT7h6kr7mRsvnGSXuPCCMHIbUI-XhXhpgNmsrx33SRLpXvdf9BSbCXMYQd0fHfoiFMXed2gL83hAgU-KNodrZaSKm9-r41fWyMXk7wTGD5HY8d3OAUi3LUxymYmZde6Rt4kwCOBjKgs_ADKxAcM-KVbgwvBoUjT0REBD3G--TOaFAtH8OBNrKvAwHHCxI_My6gGjUxakUBCU7LtUn5BGr5VSj2DM05N4gASwXRaPBRK4-Lned6ZYI2MyRDCdkWUaV4q9BJIFNQKN6gstFKE3QKQGQjPWa8SwrS1oArWRyjJVR2vUD8QNFL8V8lZTm5yUuyR3WPCEQP-Vdw7HUIoj7xqqStmhBQbPslEhjRPcbM8SmY_EVgNjcnlvIdNkhNTfpgaoNhVjoM9i3xOqTkS0aRyGxzevei_5W5krG2B12iS2t98Dsw51kMCjz_U4kT1k-4Op4e4iQgvhqB&sai=AMfl-YQ8ZysGIsdFodJhrWCaxOi2Q7lMqeOelmhYqIudMxIfR6PxXwbrntwYEIEN-zeNqSHvy8D-cEyubsfdofATrJA6hq0H29WQziuDOPzjcEZzkmrERHmah0BwUR8F0HltoPvF60RYIMrd3e55ebp2c9EO1zXhG1abMLY4tDh4q_PSJQcNN3D5OHYF-e4lAVimC5x7BBPXcIjzbhfKw8RUKyK-geio-V48hBtSYCA_xPXhnxM5DT09NWelQY95KdoGNoA7hRVYEYNA1B-zmJrV9tb9HoehUopxMXVqgGVQBRyzfppyluZEK2ULjTdbYFnj5sGDLTTc4gXGsQN8qXsfXrlm9oQGRz8lJH0qjkukCb6S3VGDNo0oBQWojQStumldoNEVRro7XJ_npohiIyQiz2u7QXXr-k7DEoPpvIs5t8hLBP1i20VagyekK_a0vS18hoSIBxFmBhzGYW30CRDqLGmorKRHmVdeqULLV69NxY71HhjDvtbZnXy1w7mDLae5YXq60XVlcPLf&sig=Cg0ArKJSzCKKj2Giovk4EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly90dWkuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=509&vt=11&dtpt=268&dett=3&cstd=239&cisv=r20240214.34644&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H/1.1 200
OK request.php Show response
hal900023.redintelligence.net/ Frame 63CC 2 KB
1 KB 105ms
79ms Script
application/x-javascript 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=01530f5b42&subid=&uid=a03d68570cd152bb&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=336505209878&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344824950&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 29ac220f64049a5b3d88ab744db2ef46c608cc201fdde4e784af984f7c2b9b25

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 12085700167533604444554012602023
Connection: close
Content-Length: 853
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame 8BAF 51 KB
19 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 253644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:38:21 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame BB4E 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DBu0AjCkNBDmdqREzFnvZlMe4Ci3i5fgeUwDvxaCe_v58ShQDCd0kmry5gla-AEHMO2Jtdg3Gt0nhPbdbR88HZjDDCJYBwyiy4iTAWWti6DatHZWDKAw6QDJkriJzV5pD2V5p_wEP21QG83MHPc6Kc9RqBg_GE1Sc621xjnkYmtHlHc6g&cry=1&dbm_d=AKAmf-D4-gBld5zB5VjSGgno022d2G21_6T_Xi0Wp1DVDaf3Nq9MKJZILx9n6-cZBSBTA5PqmVfUYHrdzYZ-q1mwKTa8x6lP2IcVIY9ijBbCRd0pyZCjGzRXA_KRVeKuFH1QtytT6NrcUHnNaKPUhhoAKy_J-NtglPfhmK6M5mt2cuxA7ynubXeD1GnfKJzrVQo_1Yt6VWFR9VQHqAxX8_uFoF_p33Ab1bgQFHH6pXka96p5GRJ99EYfnOS_g1V4byFfst7lRgnyWD5Gr-WG4BXRLuxLxVWqWPMeancYRbeN7-cPMwY2WaW_FUL8oUSAumhrdgR0u-vUoOyRdBpdcuxiUC_cknvKx__QYuR6DoH_jD7171BkLSgQ5f-c77Este8rif60JuPS4FUjkjbY69n12-ZboU0qRyz9LUjBB7A88k-kFRQyREaoOUKNtFaa-v1QAyrCpIeLw-HaQOheSfiTRPE3x1zBfnIPkEQolE2tIb_7I_u_4FZ6k_spEgK8PvSHx4C6B_11oZ-2u4a0pynkhQk5E_jmg3mRVoWrit8XtlTbEExgKpI5mzAZivIBD7bbupJLW7O14hS25ZwkyetdcFAT7Mrrsn0U40GzMaVNG0wzJQvtB7ikmZYJXC8gxEH0gjdPXJeIqVGBup3PtW6JJhD_Ig8nEwGpcJCvYIpdjkkh9_sDdfdbv9eEssOppS8bvu9MLgwrE1-DDZTETZR28eP6Hw7aivSkibhEG8ASNuv0DH9Q5EiSJ-c-S468jp4XWC3x93xR7iJ1zNJrL5ZZShzsd1Kzsw1LrTXPnwkLhXURESvODyEjFC707hKdMiY-rw_s2b62kxQlH77lumSnL_PEBl84_CalWLEDvPVM55hd6mPgY2m5J9_kMEYxpnniHhksv_Wq6K0eFxirH2maPUyTTurCeuzNaDxTWxsg-6V0JHd9IujzJP6i6P91_eGkozNDvtzYe0pTSP_Ec-g13dUXKJobe9TFOA4q8hba9_D_-WhRNiCksmDpl11TzwcHm_YvfUTntmE-X2LkgtB9j7_zzQ8C5Fq8-_d1vmTpHA924-EGj1E4yYvWXAPTA-900G4gC7tk-RuKYkY0I1Z7qXFl4BrHF1MneloXAF35Rzlp9NP41OxgMj1EVBNNBVfZnTTVmWH1oN1fy-7OX5Q5jpWOKeOWdW131Fw-wabAOhL8q606XhiTbc7D8qcHwqgG1UG8imMYJBQaYufuqvsmq9okOPPthTTcEAZgyoOxWjIg20edzsa-EwC_0Lv0vnssY_tkowsfdhZdusdYBnJ1c8NoHWbL_ZZYH-MoeYC2IKy8Y_3A1hpUS-rnmSU9maC8UHWHmLiC_zsLuLI4kpJMLICbL00HmKfLdpeoq5s4Ix9YZpGMKGJegH_q5d53xp_DCFAC-1QmdbgZddsrW4ZD8Dll-61X6YT-N0pEN_O6P2GmjC9DHkF-x7lUO16k40WKHa2QonWFz2LUCPJSe4WT_R-y31yAhptqAK0jllEBuxFZD_O6OrQj9xug5Gb57agyFFu6j_XrjPABmFeG11yJliRv4NXiLT0AH10xHdK8rbnmRYz0bLVlIFSudBS_cfpbSI8__FnEObrv2mXjZChMdgPKjOs1SffyTGax3DroSNodQvs4qjD42CnDJdnT8Sw1Gk6R-0kpP59_b9ELE42wlFKXlNBHGzyecif4cMnSukbaK0mqA6HzC9pLnFxdQ8ZHI601UX08UXpzu6xkcAO3jyafOWMcT1NHvSlEvQnV4pkjLOEjwsp2WODS_JOs_rrXO9V71Z5nOgkKCH2vA5KcfL_j9OsrDB213I2kcsdh8k4T7r6fpZ0Z57EcnrXBl9HBcCtnbtnzDwRpxwT5ULevpf8VJCvSgB_1MhZgeyk2uDQdtOZCxy8VEr1gHhgrBbwGmmu5b-81GgoUUtCK2Bx087TS45BvhcTUIMv1nNlgtjrXQBk0AEv_dZ03z0mtzfKA11w3aQ1cc0v-aUnnR4BTzBYosvAjY_tIIxUWTtwKYS9E4AZoCZWmeaxmKNFh_kPqretkRpZow8mYX_qQdlKl_w_GUiQqEZ4QIyBaHZr72sSHEWs-jtN0Qbpzp6ATISO4r0X7xl-Xit_nfdTnHbfJxXb3kZUOLWzqbS5xdSVv8U1qfIJRttwZlDycQ-gMDhGtHk-OFRGEWbI54hHwJAvkQ8DsCqHOmIqT4hpEIvpwR6L55TZElhHJflhgB4ne1F4iNrReN6TQihL4V51fKU_L9ZR0u9jqmrD3vrkm42hCeF-SYpdbq3uYY8RFsOpUwpc8ZVZsxgd2-72QeB3tLXX22p2nTYBlRBPpoOgP4bk9tumDn4dJORunSUdPUMBD1I6vOThDn7migJ46jsJPoPPW2uFUISVaOKmXnmoWeWMrIlzbfUCBA-uy-qj5OLLw-rMuXeYXwe2ZtPyhwfc4EkH91CxoUUOGkEkksygrPNa04fn0xJk-B6BzVfhCjjwCeTcpK_wLENDujXS1po5YnM4_aJHmyYLAFWA76uauvRDAhVpSNVzbjR7nG42poa-WSpv82xS17KVMVSIfjjMYl4jgq3EQ3deWkdZIO3C_LPHr7L76IXltuchuaBfxvpJXxaQXWBcR4Md9XCn9F1adUNtg8W5OxQnND_5wqyDn1Im0-05wT28psv5qBIhxRXPqh7fnq_dIs1C-7UEZ7a4liBpd8iKGBy9WDcJJ1VJRAKxpqOFE54my-_BysdIl7GsF_zKQ4HiOeoigV7fhix0aMDsa1YqhYm2uSBSf6D93h8o2RhZkimhefG760xUrzZMMOVVM36Ecx61N5O4c1Z3ecOtSZpFTSFJqDYEth8NlYiOEm-GnBnkxUyWLqhj1jNRRVdS6K1ZpN7vf77RZJRGdLlC-qDJfO0-ZGPFOS2RnOQ0dky6hmVgjJ0l7DDWBfbtbpldA_yObYF-weeBMh41nCigwxheSWMwaR9YKosx5jSoPyXejGm2VkdXAqE3zsN-CwDCCWEJoM_Et35k9C35FSHXiQ79A8Dp8jwFuzduiXpWhuBQXA1JFmkn7lTW9ECQnM7Isx2k-otQdAc1rJ3oqaZ3TvS82S9adv31KgBbaxPWfaL9KLKazxEGAn1rEQcB_97UdmpB5QWF1ag1LDRlvVNS9MvaqIufFf4CYTJjud0LbyB9kb8lDlCrCa26qX_-poOeJOAFTMb9YybTxel8To3wgYC2He9GWI4ryH2-XkFbiILCvx3lVp4r23yDg_T6GSZu_Ms3nSgR9PJPRQNSTylk00CDQV7rjj8OZM2ZS4VsnpuED_8fHpwgql8ILWJ3HOltIUCiX4h6ZkyyXpRDOdluoNTJ9N352HXz29UB34G_FTXVqyaYqj8gP-mXy-3L7u9G0l9aiUQzdcK2yE6KhYqZ9pg2o3qUMJfSTJlIGa0Pvqo1wfiljq_dD6MGZBEFvUCqyKobNUfXZCnl_z4bqpEceZgc5B5ZEgiZ1VxksRGWLYbNgfNHlsER4PHjcOQb1KeAQIKhpfV2-bCX6EUVNcguVF5ZWtluXj1Bc68M6O-tOhp7j1CjkpRvqRdHJlumzxsIJVeLK5nf99e3esVCcfQaRqF8YWCmdopjvTe4txk_w-so8dlSBLqMSZwIE8P7x3CoeT_-LbMwCy0Iz9-GaaDWL_PiNOy722BOLlfImdYIo4LayLR9WZMIXBlkC8WKJckJqMQjwxO3h57JGI8rFvVBuvUk0VWXVS8cO7GD0KuEtK09V1hvXDxGy4Y7ikyYxEsVegY1I5ZzAGOVFY49Kh8UR74mSxxC-cll5bfdzWlHAIJgCqY6e3djaYNfKViOtDt16Dc6z8pglMIyMJLoJObyeZxX0_VjO3QZ-oXqV3dLNLu5jqypAmtFzRS0gRTmeJm9_FbDweRsGPU3myL1p_nQOhzCeJ8XyMzlaPZD_4egBmOmDg4KLCZ6hlXEjvqSvQpp9Zn5NOTQ0nSiR7h2FYeWKotHE4ZGwj_oaRK6IBXzi70x0VxXIZ9vg0lClsnbbQYPzXeteLDbdWoC5FEmhLSR-6ew9gDjpyQ_ZhILpQRxTiIueMhwDAwZw5IktMKtga4qRXia2i2A-GiwSQil5ATwFCTcLn-GkKschbJXe6xdxdVjyOgzWVANcWa6aZwltmu5nYcjxXJUESkTGmW5pKiXHXfHZqSD7V7bw5_FAYGENrzuaoUphiy9A3ycHti2GH_2K3Tjwg0Sz&cid=CAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=843387727915097300&adk=3944675603&idt=52&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9567
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BB4E 41 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 295081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTY3NzE3MwogIHNlcnZlcl9pcDogMTM5ODAzNDE2CiAgcHJvY2Vzc19pZDogMTcxMTQ2MTAxMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame BB4E 0
22 B 45ms
45ms Image
image/png 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODExMDM0NTY3NzE3MwogIHNlcnZlcl9pcDogMTM5ODAzNDE2CiAgcHJvY2Vzc19pZDogMTcxMTQ2MTAxMgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNjM3OTk3MjM3NDY4NDk0MzA5MApkZWJ1Z19rZXk6IDk3MDA3OTk1ODY1Nzg5NDY4MjYKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"9700799586578946826","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"16379972374684943090"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame AEE8 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
H/1.1 200
OK request.php Show response
hal90004.redintelligence.net/ Frame AAB1 2 KB
1 KB 118ms
87ms Script
application/x-javascript 138.201.63.116

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=860956e842&subid=&uid=2d96baaf6323737a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2679731359529&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344824522&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 Papenburg, Germany, ASN (),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: fad5a329f35135344c2b6de9f76143a1d1a8c94f1e5deb5e867eee6129a2fa46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 79818900173464204444554012602004
Connection: close
Content-Length: 855
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame CFD9 11 KB
4 KB 23ms
8ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344873975&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCI6AQCLLPZferNc2Os8IPnJuh2Aum5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JvpbFi_TJJPOSd7ZfFUx-hvgbNmR3UxVxNm66OKuNc6xSwU99hShn3NGioLcOdv3ETflKzZx0LLfnNiGGaXE5_SJ0xKKgqk7MnBBvFUCuXwkf6ZBb5XefWSwV867RUFuWH8uwW5YRmJpZBPfLk7uADnXY27Lc8mDKxkHPPkeO0HDBLeNacc0vE-avHAWdpndlYq7kEAx0UsqoBqyq5kZuUZvEIZGYdujgvtnoo0KEe-KwXa70_KrON7tfMaLFSNeChFuyKQb02Dhckc2LlJV0SXIkp59Ek3NGufGwM6LFot2UC95oQsOKp3F9kPJYozn6247e5LkbEevkD-UzFXpry8gP_dfFlWUO7vVDIRwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljptNfyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ%26sig%3DAOD64_2yWovqSr2wFNF8KyUs3H_XCnf15g%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-BhUrKX_tLSja9MZ4TLFLrJpR7RTOay95Jp82I-NArUSdJvZC9rc6g8FD5hj3kHjA1Na7PLjIOKk8c3PdzBrsMRAwQMIdO-5WU9XnajXE4GnJ7o-M3gZTKsUNzci7txL7aXdWQnm4T48a3dQouikbLeeRT0c5_RGn2Fqp9MXCNOkSLGWBs%26cry%3D1%26dbm_d%3DAKAmf-DhFTwhqRsoEbPLWNQvO0Kn9qgNq5DGdknyFXxGEvjdysqnJp9KX1cixyI02zwlpb5VU5RFVNiGJ_XCUBEH2Jp-HCBVhQufO0jz1PzfMDdOu3v-AoBSuNCAdSriddbAkRE_dwWstPbUnvG-uDzffDgWGLJ2IzeXb5X8VO7aR-TFIQeBmRrFD6QWpSj1M8lAf7f2lGUK2qOrcrzS02DoFcmW2RI7jR62DUXHbWtzETmPLBV06ckCBkK-uQPipx3bqyJjVmJmrz_Cbo-JwEfIIIVttgKl4HQdp_upZyMLXzK-IwjhJ7qUNqAeP7hD1OBs3g2tZ0rPur8zg-s6oX6zxcK41KhTstdbiXFlDw5B2Y9xqc_prDEqbEPLP03tGfOrYruEyA_KdNcPNxro0wq6Rz75kdd3aYeeac_sZLC70OSWg6f2QGUqZnNx8qz8_Sjp2__eh2ZZy-TMcy3nRIEmRPfWbrjqUjomKUUWL3pVzO9mrjQA9AgdY0brtghvL96teBS1n3ezgQbG7drmXPTLKTcgI28nwBDue2ZKhFKY7A1utl4c_C0%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 38481c33122e57cccad18cd0b1571833fda26d73c77e7926d1ab9f144eab6276

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4205
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame D4FC 39 KB
15 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame BB4E 11 KB
4 KB 22ms
8ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344834965&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCK_NiCLLPZZX7MsiHs8IPpaCg2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObhICABKoEjwJP0PPsQbXRpwhB2Ij7zOZ1w7sYcBUPK-20kmX5rKLFEI-VjG69hkRIrsgM9xTP5quMYluWpjqdJc_fVyFR6tzkVW4F7i1St-LSzfcsJmQkHXkhpNEtYM-QsRAoki8wEKCSpsIJW2t9Q7j2mjAJPWnJ5PeS3Ok95leYIDCoY7mwG2DxYC_BbXLYwLClNsIHaClxQvHSI2oaLS7MKh85cgEQ1aRrm0fxh-R6pLFQ1aV66yDdeEcrF2FhkSRsbMvLM0UxDRQ3WuSQsy9FHhkuBYZySNoHcPK75JwdOp_ucNlQQZXxmTFhTqHlJg7R47BIxXU6GAKNDk7RdTNhIlZZIHrVw8vwGNXV-VCrf4kt0jKpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljplNXyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ%26sig%3DAOD64_3UcyAVSnaJShhJOwMtyrdWKEqBqw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-AmH3bhAFrY06GfzcsR5C2Viv1sbC_WByqeoKX4OyVtrdytgEWzV3a3KJq4GJ1MuabA8QVROvLlyXTub-XGoasmlaUOiSAFSrUfEgcGbZXfuGe_bnue7lS6yiPOcFjEfkIBnSkOFJwJM_jpdOrF6TTEQEn1L7WiPXvD3YVh7CrimiyaH00%26cry%3D1%26dbm_d%3DAKAmf-ANG7XQCc0328pKazPhB2zv3T_VG6yD5JkFGkbyMd-ymzlEJVi44hLSTXKzaejj3bel9ETwJtaf2HdCeacglqdmIXUFdjtWRqXVW8yLbtUa1BqHadUbPH_bDA-Yett7r5vpaHYlZHi4xo-t5JaFdzpRcRtSroNq68L86IjI0F4DWzHtGeiW3qKVinQEdRWngF53lajB-_GA1G2-EPccEyUqllOqGPUQ8WL39OmApA3YmAfN8-l_6N34raO9rayD8aH_k1wTWwgjNFl7xhWKl9Cfhem5cQrV_TW78L-qzkE94rndeRAWTZwlA8Akz6AU1axUbonnRDwPzzvB8ptB2B3OSBKRrN275VlztFXLySmiMgneB6oe8XLQjlva_d6ukrnz1X8NNz5VKdSiF_fobPeO-JepN_y_RvNKZ5xYBOCsiBqRGseu6S2HKuAqjzel8aGjT1UsIqhQ2BKntBpj87cAJiFb2JYYgNi40h88Js559TxRnx6YIHWOmXl_ny0MFeMxjfsI-Wh9H-7Sp81L4GpgaZAAcaIG_CSK96vTKbqVWXG9HJY%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e73e98ff6a87df9b57a0691d32b53e5a5858e7069f9d1e5088d6eba1070f2232

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4207
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0690 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F254 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bg01.jpg
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 39 KB
39 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/bg01.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c4825d7fd77de861de762a33f39fa482b3af1f2ba98aa86eb38d9ea6773a56d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 23:07:12 GMT
date: Mon, 12 Feb 2024 23:07:12 GMT
x-content-type-options: nosniff
age: 331113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39424
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 txt01.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 8 KB
8 KB 13ms
12ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/txt01.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9656f1c6441bc2d56cf99853402ece39a2ea25f5d6bc21a1b3b2a99b37289f68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 23:07:12 GMT
date: Mon, 12 Feb 2024 23:07:12 GMT
x-content-type-options: nosniff
age: 331113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7883
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 txt02.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 5 KB
5 KB 18ms
17ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/txt02.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa332c400287200d9f0da331da87dacaaa11f0e24b665671d1f869066c494771

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 17:35:06 GMT
date: Thu, 15 Feb 2024 17:35:06 GMT
x-content-type-options: nosniff
age: 91839
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4905
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 3 KB
3 KB 16ms
15ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7c3f4d093fee9869fc0b3cec4d45e4a2251152f986f8c7290b422f39c3a0f00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 17:35:06 GMT
date: Thu, 15 Feb 2024 17:35:06 GMT
x-content-type-options: nosniff
age: 91839
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3524
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ctaArrow.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 2 KB
2 KB 15ms
14ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/ctaArrow.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcc507df54fed17df8e34e5ee4c20ab098dc919982b14d5501400f775b4d6318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 22:10:30 GMT
date: Thu, 15 Feb 2024 22:10:30 GMT
x-content-type-options: nosniff
age: 75315
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2054
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 5 KB
5 KB 13ms
13ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70b1ad29ddb490546d618f0890550133ed2ab17270feb61c37b8b0df04ca1a5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 23:07:12 GMT
date: Mon, 12 Feb 2024 23:07:12 GMT
x-content-type-options: nosniff
age: 331113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5035
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 legal.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 14 KB
14 KB 20ms
19ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/legal.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b96fa1fe7421282a5247b3e5ab18605e45e2b21183cde7c4181cd62616054436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 23:07:12 GMT
date: Mon, 12 Feb 2024 23:07:12 GMT
x-content-type-options: nosniff
age: 331113
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14793
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 powerline.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 2 KB
2 KB 19ms
17ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/powerline.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1464ea84fa1e48ce4d34c707f8a05d05e943b9563b85077459480366b9d75d08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 17:35:06 GMT
date: Thu, 15 Feb 2024 17:35:06 GMT
x-content-type-options: nosniff
age: 91839
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1590
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 info.png
s0.2mdn.net/sadbundle/3424405613191866553/ Frame C0E8 1 KB
1 KB 18ms
16ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3424405613191866553/info.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f9f0d1237d1cae793185b08577e76bf5403cf86d94ef84ff7cd900febe583e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3424405613191866553/hp_styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 17:59:51 GMT
date: Tue, 13 Feb 2024 17:59:51 GMT
x-content-type-options: nosniff
age: 263154
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1310
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 13:47:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 / Show response
adv.office-partner.de/ Frame 98B2 930 B
922 B 59ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=c48e9e436a&subid=&uid=a4faaea9ca475e41&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2283732214845&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 16 Feb 2024 19:05:45 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 23 Feb 2024 19:05:45 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e5873e27022e22519b6a9 Show response
pv.medialead.de/trck/epv/ Frame 5132 0
326 B 71ms
22ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873e27022e22519b6a9?subid=90620400174352904444554012602025&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=c48e9e436a&subid=&uid=a4faaea9ca475e41&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2283732214845&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103982","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Fri, 16 Feb 2024 19:05:45 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2

200

htlp Show response
futalis.de/ Frame B9CD
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=90620400174352904444554012602025&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057815

350 B
401 B

34ms
5ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057815
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=c48e9e436a&subid=&uid=a4faaea9ca475e41&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2283732214845&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 16 Feb 2024 19:05:45 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057815
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 link.html Show response
track.webgains.com/ Frame 3FA0 2 KB
2 KB 157ms
83ms Script
text/html 3.8.213.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=90620400174352904444554012602025&nw=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.8.213.175 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-8-213-175.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 30599e1cd9b71475e2f0ba24fa44496d3b92667052915473f023bbabf01b414d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:46 GMT
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 16 Feb 2024 19:06:45 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900025.redintelligence.net/ Frame 9181 7 KB
2 KB 24ms
10ms Document
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=c48e9e436a&subid=&uid=a4faaea9ca475e41&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4i08CLLPZYTjMND6s8IP-rmvmAOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0HDUHzbSNdyECbiyF8vHMiscUWvZNU7WiLk-6UY3mEu9Ouu5X65CH0Lyz5Esw7MdPqTi4lfXi9Lh7aXVS3nAk3eBAYIdSvv-_bEU24oQOxMpjznKwUwJ-z_SHZUffN7oJRSfVNKLcMyWF0KXbgpnVgU-H2cKkAG8VAFXTDcQenBZl_4To41zRF7P2M5rqhH_QF3Q5GuA8pZziKHhg7FetPixWY2GUODduAsMkLwdg2z2xqjQGWRx7_v2haZYD4AwSoE5ZqXpT2cSkN57t5lTY7KpNhvV-tpuEBBTccXwxqDCQj_HoTk5KtYUcgZSbS-akSRISz1_DCg-hG8HaLTxS0RhxEeR-xdyC9VP6LCmZTWDlB6_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliogNPyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_jSryzd3AWHOTFjoTvwvfnQNI2jN17htaBZDUiYsjcOLrBuy6kl4ChElySFz2EpFXsYcntqACcy-fhMXeQlgDn7xb_S7Y9JNXqBgB%26sig%3DAOD64_0IZtKuEHiNBo6fkBPiMtZw3B5hRw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DtULSYZSBOPjXDRHszcyaddrgp3G62N791pG8dWWUdnsc-TBKUcwMTe7wcAxW1II37n3IyaNM_yBY5zhw3dqHoJovoQHEQ0DsR9qAVAEtYjLR3zY-OfxeZfLkJdyeCuZGDM9Ltw1-ulsHpzN6Dgfn21HEXjg1rJlwYD26XfpD7ShlN1N4%26cry%3D1%26dbm_d%3DAKAmf-DGJ7sXqFsyjzQatn-7ZmW7HB5kWvUh61SzKdv8gpxNFAcALujOsCmA3H02tCNKalkIQ_4Q6ogTjxyVe6aiQflvPn_fnEGa3-34BKTUkWHB4O7g1FRLrMImVOJ0QXzkoPuPG-lRvVLQ55gawsCe4b3GP3Ad5fSdX4CAIqce0KrK_4QUL_B0CCBwo4pELxp5F0tMX4xtiORqOvgD8QWEjPQYjGPUJ7DiZRnakcTnPDEjNcbqPBJvLILNTRnIGJdF3wuBgeqNdYoGipMd473-CieHzw8zVBjG61oRRLZ9n_a9w5uCA8Ktwb1Go6rXGWoQSPbqDtBaYPUr4XHYNaay7lZMwd7xwhRDMtM-g2-rgPsX9QIKlRkmpXtDnPzy-m4hVl4GZucebbjv0_nz9Bg1L86nSibluOiaifO7SXQALMkVb15CDo-iXz6d9clTtZFmBA0E8_8UToU0vT3OUqH7A1667782eZglOABIfP7i7lkuXGoH3t9OMOLDPYvJ352n_ZToXGB6MF2DIggk23v17KveBMVQ47QCodkmwDMUeyHz7bKaOwM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2283732214845&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4ff05f159824527909834573d7b8519fa6666e8982ceaa3edc9dffcb0390fa99

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2053
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:45 GMT
Expires: Fri, 16 Feb 2024 19:05:45 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2 200 e99aace94e6e5873e27022e22519b6a9
pv.medialead.de/trck/eview/ Frame 3FA0 43 B
360 B 71ms
23ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873e27022e22519b6a9?subid=90620400174352904444554012602025&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344648&bpp=1&bdt=714&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103982","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame C0AC 39 KB
15 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 73E1 0
0 43ms
43ms Fetch
image/gif 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst0eKAl5zsqJxzD_K_Nw4gj7z-HdyNImqLdNAvfmbkvwvYnnS5IaSOYJK6E_30LAhqakhJk6DnudwWtil1zYRpWtWQqE2oeqpZLc6ubYCv7NKh0LjFjQZV8j1AXlyix-iWf1Ggkf3ggZQkhI9KMwSiSDNBOw1tTFl85GxiEiXqz2YvNCw0hT2blbj262ntY7E22wrqtYcVQbRvLQyH2SL_OfRvVZMQ9RnjmtSHehn5Vetqn78BgYbY7TnccLGYZBt-2Pv8aHUlBd0CbvbclOKGX-F1riuQtagYQjB_7e1be2KeKDVlCOFMd4xRIVY-lXoCw9W7BLwEoX1kaGZIjc2AYJLUnq3KaXX0vrJGzcdU47hu_qH_wEOc1lwT___W-A8uLNyT4y3EuRW2ACPUbrV5sPy5HaDnluPErr6lV9bepfhTaUKMsTDodDL62hHH4fnRWY90OAVzl49QRotmfcVDjfRl5q-9xJ8hJ6mp66rQz7FGF6-unt89mj9bPkyNqCmMY48GzOzZzX9KEzVFmuGfHmYzWtLeI2KSSRDbxTb55PtTWL2By3y7hGLmoto4kM-krXN1X_4lt1E56I8j7fd_rD2WfvqUP1il5YyZQRDfRYbayYLzND20VdKToRcRlpLQouN0HFf3QXZNXq1yGtXnsWLZL9u1Ug9L7gnQlq6CkCYyk0CS0tV1rlIysmZsbaQ6cgOroJO5FpWRK9Cjdz8HMVdR--KRNnWcLxBAHzHA1ZirjAsnuSGaARKscDtXtR4uuSr8_gFwHNUKZ2L3nNSZJg0qTeoWfVDgg41NlVzs21vJII3baZAdXKmSIR6H4EVt0Vkl8c-UECoe5q49tzw7cTifms0TEPBM8nMT7cbZWlbMPy0u87r8pIx71azqQW-XW6He0R2pRevTggD-thpgqQsalucf4q-r2yuA6M1jj3SFofTnIA_cnRxvUtmpvnSCwd5GdcGSw9X7saZF6Zr60gngK7GozOV3JA6UoSlM3vFoq5PZCFsBxlPwWtPMmVDoP90Iv4a9agvnZvZAiHEYw-feujwZkaiqxS6zhxIcluRbtRFdWCv24uHniP80g7J0hIQahH7XaGNN0PVhKd1JfT-yX4iYWcxKd8YwQ6XY5yl5DZnyC0tFvbSDC8BZsfa_nTdrgzBO2tX2V_04ljsjMjjQKPqSasoH58NuwKhR2avlEj3dAXaxBPC6GLKqd9-nXbODnj6XXGo7Capuhubqz_95siZv5q1s6ob_E7iYYBmCNiusigAakRY3TAA4BcpraN2i15s0tGM1QIiTJBWk9SqGACbAJ275_Q6Njy1p_2t7gb-jSAejEP2WBKx2asreMArqf82r_eYlk6HT2LFIkcdPCtEjaXwlN7RfOJknPRKvkTGf_E7xl0BW6UD7etej9&sai=AMfl-YQnyXn0_x_JJd8-qT2FmorUy3LEYeXIIgJZHNtNzjaQFFIHgVEJIch4PeJuOEBmv_iEbWjIBoHPyc1-uxThLkQ_uF6T2Zd_4cXtW6g5Z8G-K2RSvoNgfUJh3LnTmLMLjTcuAvnZEERLWHnRp-eLH_05TXgu2xNjk1_JpEzCxegx-txxMGplxjb6X5NBUFpH6d1K37Gj6Pu9FX7uMltNG2fY16EQW5H2IT2KOKMuJmiYcG5xDroIMVrISaWuLKNpkymztkt7-Ol8GJxkMDM05D0nYdszbI5uppyMhWeG9YC8FBlBP6f9m47k8v005aMuPGwWkG8d3yuZOfkaJQadayZOd-VjgFNOd33NpFdjwTmZLuyCvkPz88zhg6FZjeCsmDTVf27uQ0Df9fRVLpizl4EzC59pHVfjMAIgvTDduOuLHCjkYGrYngJmw640c58-6esxd4CZM2qOyevpn4Ml27uoQVTG3_PMJyBbvN8HYVaXyXtE0vqbGNSKYmKHcNWgBJNsvGM&sig=Cg0ArKJSzEBysWXMmPctEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9lb24uZGU&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=474&vt=11&dtpt=278&dett=3&cstd=195&cisv=r20240214.49154&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

85-10-231-200.clients.your-server.de

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame F489 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame B68D 930 B
923 B 48ms
6ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 16 Feb 2024 19:05:45 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 23 Feb 2024 19:05:45 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 6552 0
327 B 60ms
21ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=24823500183026304444554012602020&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Fri, 16 Feb 2024 19:05:45 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2

200

htlp Show response
futalis.de/ Frame 7C80
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=24823500183026304444554012602020&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057816

350 B
400 B

39ms
10ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057816
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 16 Feb 2024 19:05:45 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057816
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 link.html Show response
track.webgains.com/ Frame 7C2D 2 KB
2 KB 145ms
81ms Script
text/html 3.8.213.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=24823500183026304444554012602020&nw=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.8.213.175 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-8-213-175.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 58cd765bcc561ec95b0c0be5e7f1a29d2b23314ba81bd7ad969a76f6a4b7c783

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:46 GMT
last-modified: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 16 Feb 2024 19:06:45 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame 2A3D 7 KB
2 KB 26ms
9ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=6978fdb657&subid=&uid=7335218ec62b82f3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC02J_CLLPZYOEMJDv7OsP6qaswA6m5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JEBm8gg3yIlKD2odsCPtQ9sGSkyjoKsvXXU4EyzIeBrZmhmDrpNoNAnYc2QafnEh8tFRdXcUyrVJHlPzLbzLcsHB6Ngs7qR24YfnlYLa_Ij1-b7zln39DDJ2M5M_tcTIni2r8xxX_L1Jf4h5CfpODnpvtVY43DQD34buudmBOVIudJEkaZ9fqYrxe3wmSqVK1Djduzhcu8hbRv1CYI0q6C7nZ5tm2rKmjtACpMTkE8HEeVfPpE0NSjL6DrUUtsUGsj8Ilwi-Ns6BZSkW3ya3MMgZUOnFZlm6wwDNHoTme8B9gzrZByw-WU1sYqnamqpoQobFnT7yUm5kk9j5MahTcqP4YffH57S5j5i8OPEwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOlianNLyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_B-VB2pn3swkNWtvu-fbs3Jf8LgRqYvLUjrejwhfdBqsTDLhsWW2prFgDK4sQNT1tkYXBUCzOF02CnoyeDBsqdijVR3s5El9F1BgB%26sig%3DAOD64_2G0W09NLkoi7a9Pp4oXslu8tOjeQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C00B6moML1c8kubHzGOf1H8h3hfp7F03GqqWvnjxwA8tUNRPUYgHPZMd9K6rRyNHbdRYzjg4nv4IWX4Zzje35JTMlIUdZbXz3JjoL5MrOZuFifhN9EIklILkNxO-ot0fyg7s4w04tuGUIITfJanOyBakylDdRnunOtF_zUWo4dzyUpB_8%26cry%3D1%26dbm_d%3DAKAmf-BbZkTtwuTtV8teW5bBbyRSN0Qn2RGdwW6lfKz6A1eQS3z8HqeQj2RyFLmSGrBek9FwaN1_TJBcQVhwPWJarmb6CqAbCTnRo_Y5gy4iqJdwKbv2iPE0gmvHX-ZkXkWPjPP3kkE0r-AQicoZy1y_MgngOJbte4S_krO9znpMkvBDf9OcA_44DY1S2963VZetOXRElVdFg04e1r-je-cP4OVum_VKe-ophl3hxFws7T_UWCY5c_O6Hd7HFg-CgxQNfZr8_c89P_YMb3GQ5hm4zSpo70Mo018gp-i2Nb-gtYj7RAfW_W-2Wa39Q2kH7sZ2FDAgVLOgsM6S3kibNCm-HJdMtw7NrQ796qEBkY2KrtVTW13uneVFn-JiX8K7ZtTd9xe6ORdKdN-n7z2yreponc-i0OdBBR_AYB-qf-oGSPV_5iWBumaC4LW860vOCNom7HSEHncC7NzMVL2sG8mvZoat_CnclXsBLBwQhqDKxNWj0s_RDosrWhwnx-Z9cFhOhoQX8wXojs7RkAXQZ1VVk-sBr9Lq7r4kwheSLRSW2SXja_ZTpis%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5999763393628&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: ddf48c50965bca82c46da531ad075fd403b7ecf929819f67338e183ec77da9dc

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2047
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:45 GMT
Expires: Fri, 16 Feb 2024 19:05:45 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2

200

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 7C2D
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=24823500183026304444554012602020&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=24823500183026304444554012602020&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
360 B

22ms
22ms

Image
image/gif

91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=24823500183026304444554012602020&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344637&bpp=1&bdt=704&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=2
Protocol: H2
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=24823500183026304444554012602020&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Fri, 16 Feb 2024 19:05:45 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame 565A 51 KB
19 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 253644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:38:21 GMT

GET
DATA 200
OK truncated
/ Frame 3FA0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f90bb0986618a1778944591812499fe724d9f07af3ed3c664c732a087480e78

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK request.php Show response
hal90009.redintelligence.net/ Frame E020 2 KB
1 KB 115ms
89ms Script
application/x-javascript 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=f62c03c323&subid=&uid=a8d25ddf4c2d7c7b&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbrGvCLLPZfzpM7fBs8IPz_qr4AKm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NxcVBTW2gjvJHPdGSHOcahxDRKe5kVxJJPdOv-UvlVyjFyck-VrBIWQikiKrkP8f_p4wKxDEV7nkucTRHWVuGkbDqiBm2b2qleSMtkv2Z1Qi7KRjizyAhB9eE3vsSkPy-aLIRwlpEUPtT1ixkLn2d91ElNlR7ejsRPt_Z5Yiy9umJoxiyr3HnJzDwYWZ2F_r4rt0Ef0lrDw8vYficqTCg-tqFsfTEI03JPMwE5FhCLyO-ihMJqviMeG2TbYTv00kzLVp-EKNhpBp3pL2TfMU7UpzIoyGQ5mx_SxEVqrtNHXDOcwQDRC2CVGPNIHIZfUDki0HstGToqlq4FNc-aRTX5y4WK_ntjq8hSKbtI_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljUh9byxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB%26sig%3DAOD64_3vyHgHUeCmCVzu8cieJ-ARSbH_hA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Bz8kJ3p-I6nwpq4GpG1ANvCn3BLx9-9x8gHP12dcaEbmXUDYZucFPvITjqQ1NYv6Ek2aTrQb7qYCxB8l75cB8M0YhonL6KEGjZOu7n0gC8A6SjzipPjY5hk9sehZCL9eTBMw6YnkMxteZfVMJ9Os-hhFtYKq4Xr63QBNoNtMY6XMueH-s%26cry%3D1%26dbm_d%3DAKAmf-BDgNglQFpcyHOPjssL0m2pJGOyG6c-7KortzAc3auDPI0WwY9VgtLum4g66U-ciZE42KPQhUcHiXFMYtI4LKMfLs7VLeTtVn_VLRwdt8j8s-8JYICxRD_JIsmJ-4HoX0-b2G7zKY8c0JiCfyKOzaCG1zjTKAusciAhcennR4zeVcht5ZYOZgi_x3YcdHCgLkJJGQeh_ONywGRyQ_3ZkTU9-lQEo3phjd_GQJ5Bn3XLseIAfdo-2bPLWzgYJRFNjFkjYGSoRQxVykEbf6X4WZ8spGiHkdFm7dBLhKeFFDIB8lT3SiWJSeyi1A8FVKfQmuFKYJUFomA5WXzhhoOoSnbJ7xrOuv3pncKUK7mKBS8uCTPhnRVPLjNDkWrBV7jl2a85GPxZXt06t8ZpsuRNFVX5JhzuZOMMbGSw6Bz0NrxfbQl8LaliZJ_4egL36XV_D8FZN9Y9VCt_WyvuFSkRvwfK4Ypl9GiW0QAsDcdlXwv3ggEx6W5P3sCsWeieo5cV7M7BZXg9Nidk0ZUg-ppXl3JSijl6mLi0hiOk9-qP3IwEWcwjDZA%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2250815605850&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344849148&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbrGvCLLPZfzpM7fBs8IPz_qr4AKm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NxcVBTW2gjvJHPdGSHOcahxDRKe5kVxJJPdOv-UvlVyjFyck-VrBIWQikiKrkP8f_p4wKxDEV7nkucTRHWVuGkbDqiBm2b2qleSMtkv2Z1Qi7KRjizyAhB9eE3vsSkPy-aLIRwlpEUPtT1ixkLn2d91ElNlR7ejsRPt_Z5Yiy9umJoxiyr3HnJzDwYWZ2F_r4rt0Ef0lrDw8vYficqTCg-tqFsfTEI03JPMwE5FhCLyO-ihMJqviMeG2TbYTv00kzLVp-EKNhpBp3pL2TfMU7UpzIoyGQ5mx_SxEVqrtNHXDOcwQDRC2CVGPNIHIZfUDki0HstGToqlq4FNc-aRTX5y4WK_ntjq8hSKbtI_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljUh9byxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB%26sig%3DAOD64_3vyHgHUeCmCVzu8cieJ-ARSbH_hA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Bz8kJ3p-I6nwpq4GpG1ANvCn3BLx9-9x8gHP12dcaEbmXUDYZucFPvITjqQ1NYv6Ek2aTrQb7qYCxB8l75cB8M0YhonL6KEGjZOu7n0gC8A6SjzipPjY5hk9sehZCL9eTBMw6YnkMxteZfVMJ9Os-hhFtYKq4Xr63QBNoNtMY6XMueH-s%26cry%3D1%26dbm_d%3DAKAmf-BDgNglQFpcyHOPjssL0m2pJGOyG6c-7KortzAc3auDPI0WwY9VgtLum4g66U-ciZE42KPQhUcHiXFMYtI4LKMfLs7VLeTtVn_VLRwdt8j8s-8JYICxRD_JIsmJ-4HoX0-b2G7zKY8c0JiCfyKOzaCG1zjTKAusciAhcennR4zeVcht5ZYOZgi_x3YcdHCgLkJJGQeh_ONywGRyQ_3ZkTU9-lQEo3phjd_GQJ5Bn3XLseIAfdo-2bPLWzgYJRFNjFkjYGSoRQxVykEbf6X4WZ8spGiHkdFm7dBLhKeFFDIB8lT3SiWJSeyi1A8FVKfQmuFKYJUFomA5WXzhhoOoSnbJ7xrOuv3pncKUK7mKBS8uCTPhnRVPLjNDkWrBV7jl2a85GPxZXt06t8ZpsuRNFVX5JhzuZOMMbGSw6Bz0NrxfbQl8LaliZJ_4egL36XV_D8FZN9Y9VCt_WyvuFSkRvwfK4Ypl9GiW0QAsDcdlXwv3ggEx6W5P3sCsWeieo5cV7M7BZXg9Nidk0ZUg-ppXl3JSijl6mLi0hiOk9-qP3IwEWcwjDZA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5e888c140adbbacdc91fb23fffdb3829d248ec3975f96f1f8b8b347d946f5d74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 44148500192680004444554012602009
Connection: close
Content-Length: 796
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
DATA 200
OK truncated
/ Frame 7C2D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b658571a637dfc58c4470f32c03b07d1744c61641759614df1588c237adabb9f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 92F3 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900012.redintelligence.net/ Frame CFD9 2 KB
1 KB 111ms
80ms Script
application/x-javascript 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=3bb8684ff3&subid=&uid=c00a411c510c46c9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCI6AQCLLPZferNc2Os8IPnJuh2Aum5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JvpbFi_TJJPOSd7ZfFUx-hvgbNmR3UxVxNm66OKuNc6xSwU99hShn3NGioLcOdv3ETflKzZx0LLfnNiGGaXE5_SJ0xKKgqk7MnBBvFUCuXwkf6ZBb5XefWSwV867RUFuWH8uwW5YRmJpZBPfLk7uADnXY27Lc8mDKxkHPPkeO0HDBLeNacc0vE-avHAWdpndlYq7kEAx0UsqoBqyq5kZuUZvEIZGYdujgvtnoo0KEe-KwXa70_KrON7tfMaLFSNeChFuyKQb02Dhckc2LlJV0SXIkp59Ek3NGufGwM6LFot2UC95oQsOKp3F9kPJYozn6247e5LkbEevkD-UzFXpry8gP_dfFlWUO7vVDIRwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljptNfyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ%26sig%3DAOD64_2yWovqSr2wFNF8KyUs3H_XCnf15g%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-BhUrKX_tLSja9MZ4TLFLrJpR7RTOay95Jp82I-NArUSdJvZC9rc6g8FD5hj3kHjA1Na7PLjIOKk8c3PdzBrsMRAwQMIdO-5WU9XnajXE4GnJ7o-M3gZTKsUNzci7txL7aXdWQnm4T48a3dQouikbLeeRT0c5_RGn2Fqp9MXCNOkSLGWBs%26cry%3D1%26dbm_d%3DAKAmf-DhFTwhqRsoEbPLWNQvO0Kn9qgNq5DGdknyFXxGEvjdysqnJp9KX1cixyI02zwlpb5VU5RFVNiGJ_XCUBEH2Jp-HCBVhQufO0jz1PzfMDdOu3v-AoBSuNCAdSriddbAkRE_dwWstPbUnvG-uDzffDgWGLJ2IzeXb5X8VO7aR-TFIQeBmRrFD6QWpSj1M8lAf7f2lGUK2qOrcrzS02DoFcmW2RI7jR62DUXHbWtzETmPLBV06ckCBkK-uQPipx3bqyJjVmJmrz_Cbo-JwEfIIIVttgKl4HQdp_upZyMLXzK-IwjhJ7qUNqAeP7hD1OBs3g2tZ0rPur8zg-s6oX6zxcK41KhTstdbiXFlDw5B2Y9xqc_prDEqbEPLP03tGfOrYruEyA_KdNcPNxro0wq6Rz75kdd3aYeeac_sZLC70OSWg6f2QGUqZnNx8qz8_Sjp2__eh2ZZy-TMcy3nRIEmRPfWbrjqUjomKUUWL3pVzO9mrjQA9AgdY0brtghvL96teBS1n3ezgQbG7drmXPTLKTcgI28nwBDue2ZKhFKY7A1utl4c_C0%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=4219515592636&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344873975&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCI6AQCLLPZferNc2Os8IPnJuh2Aum5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JvpbFi_TJJPOSd7ZfFUx-hvgbNmR3UxVxNm66OKuNc6xSwU99hShn3NGioLcOdv3ETflKzZx0LLfnNiGGaXE5_SJ0xKKgqk7MnBBvFUCuXwkf6ZBb5XefWSwV867RUFuWH8uwW5YRmJpZBPfLk7uADnXY27Lc8mDKxkHPPkeO0HDBLeNacc0vE-avHAWdpndlYq7kEAx0UsqoBqyq5kZuUZvEIZGYdujgvtnoo0KEe-KwXa70_KrON7tfMaLFSNeChFuyKQb02Dhckc2LlJV0SXIkp59Ek3NGufGwM6LFot2UC95oQsOKp3F9kPJYozn6247e5LkbEevkD-UzFXpry8gP_dfFlWUO7vVDIRwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljptNfyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ%26sig%3DAOD64_2yWovqSr2wFNF8KyUs3H_XCnf15g%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-BhUrKX_tLSja9MZ4TLFLrJpR7RTOay95Jp82I-NArUSdJvZC9rc6g8FD5hj3kHjA1Na7PLjIOKk8c3PdzBrsMRAwQMIdO-5WU9XnajXE4GnJ7o-M3gZTKsUNzci7txL7aXdWQnm4T48a3dQouikbLeeRT0c5_RGn2Fqp9MXCNOkSLGWBs%26cry%3D1%26dbm_d%3DAKAmf-DhFTwhqRsoEbPLWNQvO0Kn9qgNq5DGdknyFXxGEvjdysqnJp9KX1cixyI02zwlpb5VU5RFVNiGJ_XCUBEH2Jp-HCBVhQufO0jz1PzfMDdOu3v-AoBSuNCAdSriddbAkRE_dwWstPbUnvG-uDzffDgWGLJ2IzeXb5X8VO7aR-TFIQeBmRrFD6QWpSj1M8lAf7f2lGUK2qOrcrzS02DoFcmW2RI7jR62DUXHbWtzETmPLBV06ckCBkK-uQPipx3bqyJjVmJmrz_Cbo-JwEfIIIVttgKl4HQdp_upZyMLXzK-IwjhJ7qUNqAeP7hD1OBs3g2tZ0rPur8zg-s6oX6zxcK41KhTstdbiXFlDw5B2Y9xqc_prDEqbEPLP03tGfOrYruEyA_KdNcPNxro0wq6Rz75kdd3aYeeac_sZLC70OSWg6f2QGUqZnNx8qz8_Sjp2__eh2ZZy-TMcy3nRIEmRPfWbrjqUjomKUUWL3pVzO9mrjQA9AgdY0brtghvL96teBS1n3ezgQbG7drmXPTLKTcgI28nwBDue2ZKhFKY7A1utl4c_C0%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 Würzburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: d604a172c8bc987d324f82874d5f2d3e83777b05a24123dc3a1c114ac6a69c21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 36957500156360104444554012602012
Connection: close
Content-Length: 797
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame BE1A 51 KB
19 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 253644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:38:21 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9181 5 KB
705 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59281e56c234b99f06646fb232513834dcad32d928f0b969f2fb0ae3791c1b0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 17:45:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9181 16 KB
16 KB 24ms
10ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c7b9abb7d4bd3d6d31b5543fd66fdcfd537dd335c015833e22da869c6eb1bbdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16519
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9181 17 KB
17 KB 24ms
10ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank-business-giro-aktiv-1200x627.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 849462b9057a8d6c93ec6ac75970fd124467060a5118d386d007a52a8d7885c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 17153
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9181 13 KB
13 KB 22ms
8ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a2ed37a6a46299d4684368e4b06f88aeda066744b56618e806c12eed4cd6b6fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12998
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7AFD 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 294906
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900028.redintelligence.net/ Frame BB4E 2 KB
1 KB 103ms
83ms Script
application/x-javascript 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=dadb2e9949&subid=&uid=13b44b8395dca5d6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCK_NiCLLPZZX7MsiHs8IPpaCg2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObhICABKoEjwJP0PPsQbXRpwhB2Ij7zOZ1w7sYcBUPK-20kmX5rKLFEI-VjG69hkRIrsgM9xTP5quMYluWpjqdJc_fVyFR6tzkVW4F7i1St-LSzfcsJmQkHXkhpNEtYM-QsRAoki8wEKCSpsIJW2t9Q7j2mjAJPWnJ5PeS3Ok95leYIDCoY7mwG2DxYC_BbXLYwLClNsIHaClxQvHSI2oaLS7MKh85cgEQ1aRrm0fxh-R6pLFQ1aV66yDdeEcrF2FhkSRsbMvLM0UxDRQ3WuSQsy9FHhkuBYZySNoHcPK75JwdOp_ucNlQQZXxmTFhTqHlJg7R47BIxXU6GAKNDk7RdTNhIlZZIHrVw8vwGNXV-VCrf4kt0jKpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljplNXyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ%26sig%3DAOD64_3UcyAVSnaJShhJOwMtyrdWKEqBqw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-AmH3bhAFrY06GfzcsR5C2Viv1sbC_WByqeoKX4OyVtrdytgEWzV3a3KJq4GJ1MuabA8QVROvLlyXTub-XGoasmlaUOiSAFSrUfEgcGbZXfuGe_bnue7lS6yiPOcFjEfkIBnSkOFJwJM_jpdOrF6TTEQEn1L7WiPXvD3YVh7CrimiyaH00%26cry%3D1%26dbm_d%3DAKAmf-ANG7XQCc0328pKazPhB2zv3T_VG6yD5JkFGkbyMd-ymzlEJVi44hLSTXKzaejj3bel9ETwJtaf2HdCeacglqdmIXUFdjtWRqXVW8yLbtUa1BqHadUbPH_bDA-Yett7r5vpaHYlZHi4xo-t5JaFdzpRcRtSroNq68L86IjI0F4DWzHtGeiW3qKVinQEdRWngF53lajB-_GA1G2-EPccEyUqllOqGPUQ8WL39OmApA3YmAfN8-l_6N34raO9rayD8aH_k1wTWwgjNFl7xhWKl9Cfhem5cQrV_TW78L-qzkE94rndeRAWTZwlA8Akz6AU1axUbonnRDwPzzvB8ptB2B3OSBKRrN275VlztFXLySmiMgneB6oe8XLQjlva_d6ukrnz1X8NNz5VKdSiF_fobPeO-JepN_y_RvNKZ5xYBOCsiBqRGseu6S2HKuAqjzel8aGjT1UsIqhQ2BKntBpj87cAJiFb2JYYgNi40h88Js559TxRnx6YIHWOmXl_ny0MFeMxjfsI-Wh9H-7Sp81L4GpgaZAAcaIG_CSK96vTKbqVWXG9HJY%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5074714657917&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708110344834965&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCK_NiCLLPZZX7MsiHs8IPpaCg2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObhICABKoEjwJP0PPsQbXRpwhB2Ij7zOZ1w7sYcBUPK-20kmX5rKLFEI-VjG69hkRIrsgM9xTP5quMYluWpjqdJc_fVyFR6tzkVW4F7i1St-LSzfcsJmQkHXkhpNEtYM-QsRAoki8wEKCSpsIJW2t9Q7j2mjAJPWnJ5PeS3Ok95leYIDCoY7mwG2DxYC_BbXLYwLClNsIHaClxQvHSI2oaLS7MKh85cgEQ1aRrm0fxh-R6pLFQ1aV66yDdeEcrF2FhkSRsbMvLM0UxDRQ3WuSQsy9FHhkuBYZySNoHcPK75JwdOp_ucNlQQZXxmTFhTqHlJg7R47BIxXU6GAKNDk7RdTNhIlZZIHrVw8vwGNXV-VCrf4kt0jKpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljplNXyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ%26sig%3DAOD64_3UcyAVSnaJShhJOwMtyrdWKEqBqw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-AmH3bhAFrY06GfzcsR5C2Viv1sbC_WByqeoKX4OyVtrdytgEWzV3a3KJq4GJ1MuabA8QVROvLlyXTub-XGoasmlaUOiSAFSrUfEgcGbZXfuGe_bnue7lS6yiPOcFjEfkIBnSkOFJwJM_jpdOrF6TTEQEn1L7WiPXvD3YVh7CrimiyaH00%26cry%3D1%26dbm_d%3DAKAmf-ANG7XQCc0328pKazPhB2zv3T_VG6yD5JkFGkbyMd-ymzlEJVi44hLSTXKzaejj3bel9ETwJtaf2HdCeacglqdmIXUFdjtWRqXVW8yLbtUa1BqHadUbPH_bDA-Yett7r5vpaHYlZHi4xo-t5JaFdzpRcRtSroNq68L86IjI0F4DWzHtGeiW3qKVinQEdRWngF53lajB-_GA1G2-EPccEyUqllOqGPUQ8WL39OmApA3YmAfN8-l_6N34raO9rayD8aH_k1wTWwgjNFl7xhWKl9Cfhem5cQrV_TW78L-qzkE94rndeRAWTZwlA8Akz6AU1axUbonnRDwPzzvB8ptB2B3OSBKRrN275VlztFXLySmiMgneB6oe8XLQjlva_d6ukrnz1X8NNz5VKdSiF_fobPeO-JepN_y_RvNKZ5xYBOCsiBqRGseu6S2HKuAqjzel8aGjT1UsIqhQ2BKntBpj87cAJiFb2JYYgNi40h88Js559TxRnx6YIHWOmXl_ny0MFeMxjfsI-Wh9H-7Sp81L4GpgaZAAcaIG_CSK96vTKbqVWXG9HJY%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 7a68441c3977e3fe7d28934537ebcc5807dfec50e7069ec224a8420ba6f21f7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 80539400187137204444554012602028
Connection: close
Content-Length: 797
Expires: Fri, 16 Feb 2024 19:05:45 +0100

GET
H3 200 css
fonts.googleapis.com/ Frame 2A3D 5 KB
705 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59281e56c234b99f06646fb232513834dcad32d928f0b969f2fb0ae3791c1b0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:55:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:45 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A3D 16 KB
16 KB 24ms
9ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c7b9abb7d4bd3d6d31b5543fd66fdcfd537dd335c015833e22da869c6eb1bbdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16519
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A3D 17 KB
17 KB 23ms
8ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c48a1a5c0eac875a3f2bda2c77e346c5e10a6ebe31ddc397a401dd6d30faf306

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16991
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A3D 13 KB
13 KB 23ms
9ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a2ed37a6a46299d4684368e4b06f88aeda066744b56618e806c12eed4cd6b6fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12998
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame E374 51 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 253644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:38:21 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame B9CD 5 KB
5 KB 4ms
4ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057815
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 7C80 5 KB
5 KB 6ms
5ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3554057816
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:45 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H2

200

view.aspx Show response
www.media01.eu/ Frame 5B1E
Redirect Chain

https://www.awin1.com/cshow.php?s=2840007&v=20646&q=409071&r=296283&pref1=12085700167533604444554012602023&pv=1
https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1708110346_63aa2ac0-ccfe-11ee-9cb2-2266c635cfd1&d...

0
752 B

57ms
26ms

Document
text/html

85.10.231.200
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1708110346_63aa2ac0-ccfe-11ee-9cb2-2266c635cfd1&dt_mode=iframe&dt_url=

Requested by

Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=01530f5b42&subid=&uid=a03d68570cd152bb&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=336505209878&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

85.10.231.200 Igersheim, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 16 Feb 2024 08:05:45 GMT
p3p: policyref="http://www.media01.eu/www.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Fri, 16 Feb 2024 19:05:46 GMT
Location: https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1708110346_63aa2ac0-ccfe-11ee-9cb2-2266c635cfd1&dt_mode=iframe&dt_url=
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 89f7480c0afa0150827cf163f8728151 Show response
pv.medialead.de/trck/epv/ Frame B738 0
326 B 20ms
20ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=12085700167533604444554012602023&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=01530f5b42&subid=&uid=a03d68570cd152bb&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=336505209878&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Fri, 16 Feb 2024 19:05:46 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H/1.1 200
OK request_content.php Show response
hal900023.redintelligence.net/ Frame 9436 7 KB
2 KB 21ms
7ms Document
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request_content.php?s=12085700167533604444554012602023&a=c18516df
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=01530f5b42&subid=&uid=a03d68570cd152bb&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCqoSLCLLPZfasMpaC5t0PmOKF2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NaIpM1DYllMsR7wVweja4atblBhE_uz3IL8YVj9iNvBEj4yP5Gypw2SEUdiccSyS6Jv1dy6-mLdC-jE5WW9SFfp6XV6f4WPsdPFoZBW67iZYsh7_zeWgINofGcgUmKxLoi3M0cUzYEwW32pv-c-YanC22szOpIkoBsN3WdpyeiKM-5MGFsiAJfMSK_1nj3HtcwOFftAhEarjYux2f71l5Gi4Ew39viYdTuVTQCxbnaPBGtP69JVNDs6q0qxuWolqfQA6U_8L0IgDyedGl03XTJs0K71b6ZNp68V7PKSyTj1krOQGVLFeNl7CxWEDEoJbgzrdEAlyeNVlaRqKPP0VEdaSFC89R9byu2eruCOwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljux9TyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_YiBJbB5rj7J558wtr-cZ5hbI0dGuxD8jZI5mO7yR0ep8SxWs7f9CB07MX3kmabJIFjySeMrfzoJQSiUgMeYmYTLFX_LObZRa9xgB%26sig%3DAOD64_0DvqD_z5U_cNyyEjPA_R03fpzwBQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPDSPhuijDDnLH9FodHpm-wXySNMtRuIhSE0nmPoK-z9bezBgJeZlJcTe8-VM3t48EyvwlxEfHm5YHKknE9YLfdXpvfG0jx0jJzHxwUgPPjBVkd8O2nng8LhH37XSDW30IpP5BePY9SX0Kih2uFvt98BXRn_YmfkCe_mr0x7ZrQNSwpa8%26cry%3D1%26dbm_d%3DAKAmf-DnCyL8-NJvNyvNXParV662eFeVeDMR9tMg-ctCDTbIUnhDnUvhCeZaS8TiXLEUUD2T4BQz3myjugCgLDCxwIr9B9jmugiFSbvnjUqC-Wu9XuQyr01z5UAlTzmIihXmkahMCbDZy9pfQWmXp3gNc7nF5f65FDhuZ3iyie7BWoI9hshh5T04Su9v78aE58-N0o8NGUbJMAYnqiMRTB_h8fgUjCaIZrMew_fGPibYeMPFUM9oJian3-SPO27g-bhJsu2BGD592wUgRG_iEVzTIfhmmWB2LJToqAk7uiEKTNVC4TJjm_YJYYhK1ty4-qU1GlvOhJ3dscNHz1TP-kUCBw5OxdUR1zztp-u1Z9hfEPJNphs_0l37uAcFNEbuEinuKY3OZ5mvPtoxHKS7Iei1nGUWRiVkksRDGHy0VSyqU3yV-oYM81J5ntgJfVJcllTPL4lgQvZjY7UKd91iV30N-dTb8d0h7Kk6z8kJwGQn8MQPNUXIvXzF77L78G7_FWkFKcs8bjrkgpHggJzgNanY_HoYCmtndOiGicIEpknWaUX-pDtaq1o%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=336505209878&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 1c8f737f99b4077dd5dfc7ac19436565503658737b998ea1b770819c9c118014

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2040
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:46 GMT
Expires: Fri, 16 Feb 2024 19:05:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 63CC 43 B
702 B 135ms
90ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3502280&v=23861&q=476504&r=296283&pref1=12085700167533604444554012602023&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344675&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

85-10-231-200.clients.your-server.de

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame B68D 183 KB
66 KB 39ms
16ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f56218011593f0257d6ee92fa3142e296d7c4e712d391aa9ab0798fb91c2675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66695
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 16 Feb 2024 19:05:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 98B2 183 KB
65 KB 38ms
18ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e6dad32cba2d1a6a5fad640423e48168f31b55730e33f52b8bc21fddd54680cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66655
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 16 Feb 2024 19:05:46 GMT

GET
H2

200

view.aspx Show response
www.media01.eu/ Frame 4859
Redirect Chain

https://www.awin1.com/cshow.php?s=2840007&v=20646&q=409071&r=296283&pref1=79818900173464204444554012602004&pv=1
https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1708110346_63aa2ac0-ccfe-11ee-83d7-2231e99e22da&d...

0
751 B

58ms
27ms

Document
text/html

85.10.231.200
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=860956e842&subid=&uid=2d96baaf6323737a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2679731359529&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

85.10.231.200 Igersheim, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 16 Feb 2024 19:05:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 16 Feb 2024 08:05:46 GMT
p3p: policyref="http://www.media01.eu/www.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Fri, 16 Feb 2024 19:05:46 GMT
Location: https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1708110346_63aa2ac0-ccfe-11ee-83d7-2231e99e22da&dt_mode=iframe&dt_url=
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 89f7480c0afa0150827cf163f8728151 Show response
pv.medialead.de/trck/epv/ Frame FA70 0
326 B 23ms
21ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=79818900173464204444554012602004&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=860956e842&subid=&uid=2d96baaf6323737a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2679731359529&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 Saint-Martin-d'Hères, France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Fri, 16 Feb 2024 19:05:46 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame D801 7 KB
2 KB 20ms
7ms Document
text/html 138.201.63.116

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=79818900173464204444554012602004&a=2a5152e5
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=860956e842&subid=&uid=2d96baaf6323737a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTxroCLLPZcqpMsmxs8IPhe6D0AOm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhkBfUn9CrI-qAMByAObhICABKoEjwJP0CzjY6VJljmx05c7l8He05ref6KTX1jWC7ZR4LO4sJjn-cAAK2Q9Si1l7h-sxKcAkEOuWU7lrqr8n4VqAnKEh8LDhyQiqYsxnJ7KcYoHSYbP3zzSlPefi0lsi4Oku4oyGOyueyeG6H6AR613lrHmnrP4ukiYx7dYjc5EBK4CXzSvGf-ZaiTaKT-VgGis2j3naa5-0hqB332gjQc54PeHAS_Irin8cN6el_kQuEfh-4k0RPvArWYEYxZUTKn-7uVLXvUWp5I7reXXSWzhVvMs24cBLkw5meXH3uB5vCznUxSHzOMDwHghobhPiJzhBI6kC4nR6hXZDpHIg9GodH1yKgOIGUw8fXVKdmw8pEYfwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliEwNTyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_tuyBFBHawZ0wEBa2zUnJVbuGnb0a8EW27w2am1AvE6M7fb5MCoqW6jqreO9Q0U4bxauKneOOHbMRnapKDy0CZmZ8I0BaU-Wo0xgB%26sig%3DAOD64_2EHjpyA8Ektog8UmMDENvt1fP2VA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DilqtKTL0fpbKf9Wzhidxv-0dBlbL10813MU4eVmLK3AxZk3krhQ-iEnLfk6ZJKhIylk7cgmb_3nqU0YEkhGqRIU9VL9I4yNtc4rUdM2z5MWs-PBkH82mZX8aH9B2VYzWBKHK-EQpP62xpqGldSTZSaZg6e0_S4YOOihSStpHuLPgYoCc%26cry%3D1%26dbm_d%3DAKAmf-DBGG_i4gt5DA0EjfH9yFwFb8ehFMt8LeMR5oeedexSnwvqvUlI7Hxxqm6FjxqZltM3RNBQGa4SfJZJjv5Ghul8-oA8qOC_iYIhrZdnswvXssTRHMf7p8FB3RZo7oKe6GyN4nrJ9Kq_yl0m0xXav3qDI99aEfBRh0uUWkSPLtc-e2SWh7E6rI4XMR3ryMWGRZAY8XxheA-dZfNcWyBeyX6ndZovMF2MmjaF9-hljEJ6-f30U4MJwTNXOKwFrrB7WZqF9yX3tQqW03TUNR5-w5XBMxUeLJDsZ7bI0dywTREgJqYw40_UqburK2sD2N0xqPzU1TLpz5dh2kZmOCUkgK1a0L3zx0qm9dv98Pl0D5SCNm9exnK9rmWn49xAOUtU6Vmn3hyaq8cu09v6AiQTMN1LpooUwxk9_R30PRp3Bl6Or4SmjhdN2vjVjG_2DB1avLhFxtItx-Aglge7Ux_LpB_QHg4xufzjZH6dqu33WP2f47OiyR4XPFAu1vIzCwhji6bKT_Vl_o77I4gWn0TFKmoWQRSak5wXUyNJqwVvpki3xWUk7F4%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2679731359529&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 Papenburg, Germany, ASN (),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 80a0ce60609e43f1bc8ce5f807c45124963ad7e98d8d35902b06e90330f6526a

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2036
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:46 GMT
Expires: Fri, 16 Feb 2024 19:05:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame AAB1 43 B
702 B 153ms
124ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3502280&v=23861&q=476504&r=296283&pref1=79818900173464204444554012602004&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344662&bpp=1&bdt=728&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=1820526706&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=6

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 0690 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 18:04:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 90072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 14 Feb 2025 18:04:34 GMT

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame F254 51 KB
19 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:38:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 253645
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:38:21 GMT

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame A5CF 216 KB
67 KB 50ms
14ms Script
application/javascript 2600:9000:2127:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 1f98172ca4214b0e937b7d3d534b34cc.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 339994
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 81EYTuHZN6OcmBbAWJNkJYRXiT4P2z2dcsLI0-3vbEQCdqYDT3b-EQ==

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame 6BF4 216 KB
67 KB 54ms
35ms Script
application/javascript 2600:9000:2127:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 1f98172ca4214b0e937b7d3d534b34cc.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 339994
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: q6hV1pOCKzQfKTlunQuWLsAOlKY1vYjzEJrIaw1hXRC-WmrIgzHSqg==

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame A70C 216 KB
67 KB 46ms
28ms Script
application/javascript 2600:9000:2127:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 1f98172ca4214b0e937b7d3d534b34cc.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 339994
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 5F7nkWdjOaAHiE86hypcQ89O-kibRboWPc6Dy66h_qHxQO1n0aM60Q==

GET
DATA 200
OK truncated
/ Frame 63CC 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b14e6fff3c97b420c4ae0b865df31bbcd2b6c66f0f9f51fbb2e9b39dd48d019f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900025.redintelligence.net/ Frame 9181 0
150 B 29ms
8ms Script
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/viewability?s=90620400174352904444554012602025&a=65bd9d91&vb=m
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/request_content.php?s=90620400174352904444554012602025&a=fbfd2116
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame 2A3D 0
150 B 28ms
8ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=24823500183026304444554012602020&a=cc8f1541&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=24823500183026304444554012602020&a=7ed60eee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame AAB1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73ab3de873fa813ce06e185683ca3c7a7f7610d5302b20770632c9d8feee148c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 9436 5 KB
705 B 22ms
20ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=12085700167533604444554012602023&a=c18516df

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59281e56c234b99f06646fb232513834dcad32d928f0b969f2fb0ae3791c1b0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 19:00:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9436 14 KB
14 KB 24ms
9ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/73943/creativesup/STIHL-Native-Generic-1200x627.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=12085700167533604444554012602023&a=c18516df
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d10c332816ad1bc78f09d81feb7c7ab43f8fc505a425a782704736ab4ce2f107

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13752
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9436 9 KB
9 KB 22ms
8ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/74889/creativesup/AEG-1200x627.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=12085700167533604444554012602023&a=c18516df
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8eb13829f3093c32e5dbb4df47e2ff0fceb084f45d920cb83a498cc33f2b379f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9221
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9436 10 KB
10 KB 33ms
8ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=12085700167533604444554012602023&a=c18516df
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: eee156bff9533ab1cddf199243159b0907f6fd9bcff4dc4e5f853c7dfea160b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10053
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame D801 5 KB
705 B 20ms
19ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=79818900173464204444554012602004&a=2a5152e5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59281e56c234b99f06646fb232513834dcad32d928f0b969f2fb0ae3791c1b0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 19:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 18:59:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 19:05:46 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D801 14 KB
14 KB 21ms
8ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/73943/creativesup/STIHL-Native-Generic-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=79818900173464204444554012602004&a=2a5152e5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d10c332816ad1bc78f09d81feb7c7ab43f8fc505a425a782704736ab4ce2f107

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13752
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D801 9 KB
9 KB 38ms
20ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/74889/creativesup/AEG-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=79818900173464204444554012602004&a=2a5152e5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8eb13829f3093c32e5dbb4df47e2ff0fceb084f45d920cb83a498cc33f2b379f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9221
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame D801 10 KB
10 KB 21ms
7ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=79818900173464204444554012602004&a=2a5152e5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: eee156bff9533ab1cddf199243159b0907f6fd9bcff4dc4e5f853c7dfea160b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 19:05:46 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10053
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK request_content.php Show response
hal90009.redintelligence.net/ Frame C0FE 7 KB
2 KB 20ms
7ms Document
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request_content.php?s=44148500192680004444554012602009&a=f487fe17
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=f62c03c323&subid=&uid=a8d25ddf4c2d7c7b&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCbrGvCLLPZfzpM7fBs8IPz_qr4AKm5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0NxcVBTW2gjvJHPdGSHOcahxDRKe5kVxJJPdOv-UvlVyjFyck-VrBIWQikiKrkP8f_p4wKxDEV7nkucTRHWVuGkbDqiBm2b2qleSMtkv2Z1Qi7KRjizyAhB9eE3vsSkPy-aLIRwlpEUPtT1ixkLn2d91ElNlR7ejsRPt_Z5Yiy9umJoxiyr3HnJzDwYWZ2F_r4rt0Ef0lrDw8vYficqTCg-tqFsfTEI03JPMwE5FhCLyO-ihMJqviMeG2TbYTv00kzLVp-EKNhpBp3pL2TfMU7UpzIoyGQ5mx_SxEVqrtNHXDOcwQDRC2CVGPNIHIZfUDki0HstGToqlq4FNc-aRTX5y4WK_ntjq8hSKbtI_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljUh9byxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_gSW-s2A6DYBGsEc5t7n-TY1yr-PFRm88aMGGCTRB5yywKzeb6qeHNWdKS-VzPSqNSVrTtXbsJRCla6nZtNLQiBnNVOSoyYJGrhgB%26sig%3DAOD64_3vyHgHUeCmCVzu8cieJ-ARSbH_hA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Bz8kJ3p-I6nwpq4GpG1ANvCn3BLx9-9x8gHP12dcaEbmXUDYZucFPvITjqQ1NYv6Ek2aTrQb7qYCxB8l75cB8M0YhonL6KEGjZOu7n0gC8A6SjzipPjY5hk9sehZCL9eTBMw6YnkMxteZfVMJ9Os-hhFtYKq4Xr63QBNoNtMY6XMueH-s%26cry%3D1%26dbm_d%3DAKAmf-BDgNglQFpcyHOPjssL0m2pJGOyG6c-7KortzAc3auDPI0WwY9VgtLum4g66U-ciZE42KPQhUcHiXFMYtI4LKMfLs7VLeTtVn_VLRwdt8j8s-8JYICxRD_JIsmJ-4HoX0-b2G7zKY8c0JiCfyKOzaCG1zjTKAusciAhcennR4zeVcht5ZYOZgi_x3YcdHCgLkJJGQeh_ONywGRyQ_3ZkTU9-lQEo3phjd_GQJ5Bn3XLseIAfdo-2bPLWzgYJRFNjFkjYGSoRQxVykEbf6X4WZ8spGiHkdFm7dBLhKeFFDIB8lT3SiWJSeyi1A8FVKfQmuFKYJUFomA5WXzhhoOoSnbJ7xrOuv3pncKUK7mKBS8uCTPhnRVPLjNDkWrBV7jl2a85GPxZXt06t8ZpsuRNFVX5JhzuZOMMbGSw6Bz0NrxfbQl8LaliZJ_4egL36XV_D8FZN9Y9VCt_WyvuFSkRvwfK4Ypl9GiW0QAsDcdlXwv3ggEx6W5P3sCsWeieo5cV7M7BZXg9Nidk0ZUg-ppXl3JSijl6mLi0hiOk9-qP3IwEWcwjDZA%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=2250815605850&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7f2a139cee06bfc7bc63360224f00265f6fd35abacd8c16281d4fc903ae1338f

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2014
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:46 GMT
Expires: Fri, 16 Feb 2024 19:05:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame E020 43 B
702 B 68ms
66ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=44148500192680004444554012602009&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame E020 43 B
702 B 182ms
181ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2338577&v=11830&q=357066&r=296283&pref1=44148500192680004444554012602009&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame E020 43 B
702 B 139ms
138ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=44148500192680004444554012602009&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344699&bpp=1&bdt=765&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK request_content.php Show response
hal900028.redintelligence.net/ Frame A0C6 7 KB
2 KB 21ms
9ms Document
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900028.redintelligence.net/request_content.php?s=80539400187137204444554012602028&a=b6b93f6d
Requested by: Host: hal900028.redintelligence.net
URL: https://hal900028.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=dadb2e9949&subid=&uid=13b44b8395dca5d6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCK_NiCLLPZZX7MsiHs8IPpaCg2Aym5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObhICABKoEjwJP0PPsQbXRpwhB2Ij7zOZ1w7sYcBUPK-20kmX5rKLFEI-VjG69hkRIrsgM9xTP5quMYluWpjqdJc_fVyFR6tzkVW4F7i1St-LSzfcsJmQkHXkhpNEtYM-QsRAoki8wEKCSpsIJW2t9Q7j2mjAJPWnJ5PeS3Ok95leYIDCoY7mwG2DxYC_BbXLYwLClNsIHaClxQvHSI2oaLS7MKh85cgEQ1aRrm0fxh-R6pLFQ1aV66yDdeEcrF2FhkSRsbMvLM0UxDRQ3WuSQsy9FHhkuBYZySNoHcPK75JwdOp_ucNlQQZXxmTFhTqHlJg7R47BIxXU6GAKNDk7RdTNhIlZZIHrVw8vwGNXV-VCrf4kt0jKpwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljplNXyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_0DxbsZB6rCwYphTI0Hwd3HXKBm1QBHS6sNjX5EuZCA404WAEV0DzzE7RkCmd7Tf9wvvLniWRz7Syd1RTxF5xoACiC809671XMscYAQ%26sig%3DAOD64_3UcyAVSnaJShhJOwMtyrdWKEqBqw%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-AmH3bhAFrY06GfzcsR5C2Viv1sbC_WByqeoKX4OyVtrdytgEWzV3a3KJq4GJ1MuabA8QVROvLlyXTub-XGoasmlaUOiSAFSrUfEgcGbZXfuGe_bnue7lS6yiPOcFjEfkIBnSkOFJwJM_jpdOrF6TTEQEn1L7WiPXvD3YVh7CrimiyaH00%26cry%3D1%26dbm_d%3DAKAmf-ANG7XQCc0328pKazPhB2zv3T_VG6yD5JkFGkbyMd-ymzlEJVi44hLSTXKzaejj3bel9ETwJtaf2HdCeacglqdmIXUFdjtWRqXVW8yLbtUa1BqHadUbPH_bDA-Yett7r5vpaHYlZHi4xo-t5JaFdzpRcRtSroNq68L86IjI0F4DWzHtGeiW3qKVinQEdRWngF53lajB-_GA1G2-EPccEyUqllOqGPUQ8WL39OmApA3YmAfN8-l_6N34raO9rayD8aH_k1wTWwgjNFl7xhWKl9Cfhem5cQrV_TW78L-qzkE94rndeRAWTZwlA8Akz6AU1axUbonnRDwPzzvB8ptB2B3OSBKRrN275VlztFXLySmiMgneB6oe8XLQjlva_d6ukrnz1X8NNz5VKdSiF_fobPeO-JepN_y_RvNKZ5xYBOCsiBqRGseu6S2HKuAqjzel8aGjT1UsIqhQ2BKntBpj87cAJiFb2JYYgNi40h88Js559TxRnx6YIHWOmXl_ny0MFeMxjfsI-Wh9H-7Sp81L4GpgaZAAcaIG_CSK96vTKbqVWXG9HJY%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=5074714657917&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 335cdc907feb2137db0fd5794902c9274d5935a61a85a867fbc86a6b19bf007c

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2006
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:46 GMT
Expires: Fri, 16 Feb 2024 19:05:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame BB4E 43 B
702 B 122ms
120ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=80539400187137204444554012602028&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame BB4E 43 B
702 B 102ms
78ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2338577&v=11830&q=357066&r=296283&pref1=80539400187137204444554012602028&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame BB4E 43 B
702 B 196ms
172ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=80539400187137204444554012602028&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344685&bpp=1&bdt=751&idt=1&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK request_content.php Show response
hal900012.redintelligence.net/ Frame 68B2 7 KB
2 KB 23ms
8ms Document
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request_content.php?s=36957500156360104444554012602012&a=39a7aa94
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=3bb8684ff3&subid=&uid=c00a411c510c46c9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCI6AQCLLPZferNc2Os8IPnJuh2Aum5b2gaa2VnKfJD_AuEAEgzZTkbGCVkqCCsAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0JvpbFi_TJJPOSd7ZfFUx-hvgbNmR3UxVxNm66OKuNc6xSwU99hShn3NGioLcOdv3ETflKzZx0LLfnNiGGaXE5_SJ0xKKgqk7MnBBvFUCuXwkf6ZBb5XefWSwV867RUFuWH8uwW5YRmJpZBPfLk7uADnXY27Lc8mDKxkHPPkeO0HDBLeNacc0vE-avHAWdpndlYq7kEAx0UsqoBqyq5kZuUZvEIZGYdujgvtnoo0KEe-KwXa70_KrON7tfMaLFSNeChFuyKQb02Dhckc2LlJV0SXIkp59Ek3NGufGwM6LFot2UC95oQsOKp3F9kPJYozn6247e5LkbEevkD-UzFXpry8gP_dfFlWUO7vVDIRwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljptNfyxrCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_IH3y_bupvJCKFQtnScAvEq8zD8yswM7TIojD3DSbvtMFtvCsMrPk2mPGPADI_94o-UyZw2-cMj3ILN6Sj9Yc6sQEcdOcwQ_7VCEYAQ%26sig%3DAOD64_2yWovqSr2wFNF8KyUs3H_XCnf15g%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-BhUrKX_tLSja9MZ4TLFLrJpR7RTOay95Jp82I-NArUSdJvZC9rc6g8FD5hj3kHjA1Na7PLjIOKk8c3PdzBrsMRAwQMIdO-5WU9XnajXE4GnJ7o-M3gZTKsUNzci7txL7aXdWQnm4T48a3dQouikbLeeRT0c5_RGn2Fqp9MXCNOkSLGWBs%26cry%3D1%26dbm_d%3DAKAmf-DhFTwhqRsoEbPLWNQvO0Kn9qgNq5DGdknyFXxGEvjdysqnJp9KX1cixyI02zwlpb5VU5RFVNiGJ_XCUBEH2Jp-HCBVhQufO0jz1PzfMDdOu3v-AoBSuNCAdSriddbAkRE_dwWstPbUnvG-uDzffDgWGLJ2IzeXb5X8VO7aR-TFIQeBmRrFD6QWpSj1M8lAf7f2lGUK2qOrcrzS02DoFcmW2RI7jR62DUXHbWtzETmPLBV06ckCBkK-uQPipx3bqyJjVmJmrz_Cbo-JwEfIIIVttgKl4HQdp_upZyMLXzK-IwjhJ7qUNqAeP7hD1OBs3g2tZ0rPur8zg-s6oX6zxcK41KhTstdbiXFlDw5B2Y9xqc_prDEqbEPLP03tGfOrYruEyA_KdNcPNxro0wq6Rz75kdd3aYeeac_sZLC70OSWg6f2QGUqZnNx8qz8_Sjp2__eh2ZZy-TMcy3nRIEmRPfWbrjqUjomKUUWL3pVzO9mrjQA9AgdY0brtghvL96teBS1n3ezgQbG7drmXPTLKTcgI28nwBDue2ZKhFKY7A1utl4c_C0%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=4219515592636&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 Würzburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: b377317d19e320bb5cfaa2a09140f571f2022770fe0a9d49412b3c7ce24e045c

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2004
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 19:05:46 GMT
Expires: Fri, 16 Feb 2024 19:05:46 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame CFD9 43 B
702 B 239ms
174ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=36957500156360104444554012602012&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame CFD9 43 B
702 B 214ms
112ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2338577&v=11830&q=357066&r=296283&pref1=36957500156360104444554012602012&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 19:05:46 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame CFD9 43 B
702 B 208ms
85ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=36957500156360104444554012602012&pv=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708110344&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708110344719&bpp=1&bdt=786&idt=0&shv=r20240214&mjsv=m202402070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=1084963335960&frm=20&pv=1&ga_vid=1882595533.1708110344&ga_sid=1708110344&ga_hid=433602260&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44808397%2C31081223%2C44798934%2C95322748%2C95324581%2C95325069%2C31081078%2C95320376%2C95324154%2C95324160%2C21065724&oid=2&pvsid=4386896296972275&tmod=516903868&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS