sci-hub.mksa.top Open in urlscan Pro
2606:4700:3033::6815:35c2 Malicious Activity! Public Scan

URL: https://vk.com/sci_hub

URL: https://twitter.com/Sci_Hub

URL: https://www.facebook.com/sci.hub.org

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sci-hub.mksa.top/ HTTP 301
https://sci-hub.mksa.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1 HTTP 302
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Request Chain 44

https://p1.ntvk1.ru/nps HTTP 302
https://optinder.com/cro

Request Chain 51

https://dmg.digitaltarget.ru/1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc HTTP 302
https://dmg.digitaltarget.ru/1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc&q=scc

Request Chain 52

https://dmg.digitaltarget.ru/1/6534/i/i?i=130941833992772.597120116606310&c=tg:adcm_pc HTTP 307
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=130941833992772.597120116606310&c=tg:adcm_pc HTTP 307
https://fnc.rt.ru/1/6532/i/i?i=m7puf0RXlgsH8A77c2x7&c=tg:rds_6534 HTTP 302
https://fnc.rt.ru/1/6532/i/i?i=m7puf0RXlgsH8A77c2x7&c=tg:rds_6534&q=scc HTTP 302
https://dmg.digitaltarget.ru/1/6533/i/i?i=9643001586998176787000000018458612&a=774&e=hE3Ln6moi53_5555KtFc

Request Chain 53

https://dmg.digitaltarget.ru/1/1086/i/i?i=130941833992772.456412868242897&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.xps:xpsOA8NtcO4F4VIQRqn3E3yn2.xga:GA1_2_212601436_1623135668.xgid:GA1_2_554117063_1623135668.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=130941833992772.456412868242897&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.xps:xpsOA8NtcO4F4VIQRqn3E3yn2.xga:GA1_2_212601436_1623135668.xgid:GA1_2_554117063_1623135668.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://ad.mail.ru/cm.gif?p=61&id=WRmmG8HXhos0WBc7c3ag

Request Chain 54

https://dmg.digitaltarget.ru/1/1086/i/i?i=130941833992772.871322338837147&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.xps:xpsOA8NtcO4F4VIQRqn3E3yn2.xga:GA1_2_212601436_1623135668.xgid:GA1_2_554117063_1623135668.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=130941833992772.871322338837147&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.xps:xpsOA8NtcO4F4VIQRqn3E3yn2.xga:GA1_2_212601436_1623135668.xgid:GA1_2_554117063_1623135668.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://amberdata-sync.rutarget.ru/sync HTTP 302
https://dmg.digitaltarget.ru/1/6431/i/i?a=711&e=Oc_97iUK473-&i=0&c=up:Oc_97iUK473-.ss:711

Request Chain 63

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1&C=1

Request Chain 64

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8VtTrLbBdlQ7v5EtfY2wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

Request Chain 65

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHjsfdIqerEpfZNZSqDlx10&google_cver=1

Request Chain 66

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

Request Chain 117

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

Request Chain 118

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8VtQ9PoeKd6iuvFtuw7gAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

Request Chain 119

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDUmSckYYFtFku2H-QbHsKk&google_cver=1

Request Chain 120

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

Request Chain 122

https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D HTTP 302
https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1

164 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sci-hub.mksa.top/
Redirect Chain

http://sci-hub.mksa.top/
https://sci-hub.mksa.top/

29 KB
6 KB

571ms
554ms

Document
text/html

2606:4700:3033::6815:35c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:35c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84b5229d1afc0962f11d27c8875317a0d92da419a5e6e2cf0ad02934e6f943ab

Request headers

:method: GET
:authority: sci-hub.mksa.top
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
expires: Tue, 08 Jun 2021 19:01:07 GMT
cache-control: max-age=43200 no-cache
x-cache: MISS MISS
cf-cache-status: DYNAMIC
cf-request-id: 0a8c05dac60000535dfa88c000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8R%2FAEUtvLLkfbayAyw%2F8nJ070ZbImmzetxDvhCydlDKUJTW56bOyqAWoMDjWza1mBlJIIeaADvbUwdEmJvufjtl7mFehJuHNcXbJEcufZWXgSc4iUert39qFozD3V4733sK5JqbhmeqnZg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65c03f3e0d2b535d-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date: Tue, 08 Jun 2021 07:01:06 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 08 Jun 2021 08:01:06 GMT
Location: https://sci-hub.mksa.top/
cf-request-id: 0a8c05daa400004eb03e992000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=j6CwLa%2BWx0A5CqYQ62s9MqNeEPCfkN8MLI99i5TlNEqn1GcbawvnkbPmVfd4KtLvi2xZ6H4S7PMHNDP5sMwhISFz9vAD57BniLc6JQ9fdH5a7azmMD7BgF%2FF9bHtOnq8oP8YoN1Ocfk4KA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 65c03f3ddce14eb0-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 jquery-3.1.1.min.js Show response
img.sci-hub.shop/scihub/ 85 KB
29 KB 59ms
41ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-3.1.1.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257231
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8c05dd050000980e7d800000000001
last-modified: Fri, 30 Nov 2018 04:24:28 GMT
server: cloudflare
etag: W/"5c00bb7c-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SZnqirTuXFKyWTrCfz0zG4DIqltJ1mKQkArN6j5JEf8OycOZwVUMsUEETYLtiJLXbdfpi71wXRowPJDUGFSOiLFwmhArCtDpzZHQSBjitr8WubX4Jqkkbcu7W0qt83A%2FFUv9XycuQ1s7IA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c03f41ad62980e-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-ui.min.js Show response
img.sci-hub.shop/scihub/ 248 KB
63 KB 48ms
30ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-ui.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257231
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8c05dd060000980e8eb38000000001
last-modified: Fri, 14 Dec 2018 08:14:20 GMT
server: cloudflare
etag: W/"5c13665c-3dee4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=oaDjXwBrVNYn6TO9qGZNf3r3zbYr%2Fu5N4LGqFziBiQTele%2B4DkK6irGE%2BXpRMa%2BrvdKqlwbZW4AIVLdfkhzene8zzUv1AdWiBslcoYdVD6Bo3YIM8KkTOue20%2FIzfs2eKr4jgLZ5mo1sOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c03f41ad66980e-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 openapi.js Show response
img.sci-hub.shop/scihub/ 94 KB
22 KB 43ms
25ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/openapi.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e319892f7f2a6e0a6790ff3274eaec39df67d671429aef64ae798ef6792b6fe3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257231
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8c05dd060000980e9b846000000001
last-modified: Fri, 30 Nov 2018 04:24:44 GMT
server: cloudflare
etag: W/"5c00bb8c-1798d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hBvBFY5xLSkQovad0I%2Fpz1j%2FBygpwSA0ZguqMAf1FJKuRnI02VMFdRAtJTmZXOKmKS4bHRG5xl5dcQGpaxcpdMde%2BTeu%2Fv8TVcbLaPa1hK6wcWNCwUQ6PGe6pGqpRrjLpumtWQsd2IEZWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c03f41ad65980e-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 medal.png
img.sci-hub.shop/scihub/ 22 KB
22 KB 35ms
24ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/medal.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dd6c570e8d8c98ebe983228777f11a9f0e195c2d2f8298c034766ccd2d3087c

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257231
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 22275
cf-request-id: 0a8c05dd38000005e4a2193000000001
last-modified: Fri, 30 Nov 2018 06:13:38 GMT
server: cloudflare
etag: "5c00d512-5703"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=udj%2Fwd3OKF2pOIoCovk%2FbO%2BR3SM3FPKIn5u87L9%2BCWpUGUM0XXzEIBFiIaf5KiZRGupO1m5bEwaDVw8QDvP%2Bp0qzstu2R%2FLHIMTENbmLLz6jK84sZ4IA5trePITGcvWbzeifV6THExrhIA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f41ff5905e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 key_1.png
img.sci-hub.shop/scihub/ 8 KB
9 KB 23ms
19ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/key_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b225ff2e35c8db5378d2ac271c993cbdf6c900aceec3a3eee1c31421e4dc44a

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257231
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 8428
cf-request-id: 0a8c05dd39000005e4aab86000000001
last-modified: Fri, 30 Nov 2018 06:13:40 GMT
server: cloudflare
etag: "5c00d514-20ec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=XhYnzbW%2B9pLGqS2MduiwaFX3zcJcscbongJfrk3OlUWdpvwDN55dTAIHy69%2B5qSqkqiWQo04DWr%2BwShNk%2FbWL%2FwohbdE%2FdSm7US%2BMVdppKLtgqHhAM4ik%2BpnsRRzZ8tGiEmTDbaZ%2BFMDbg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f41ff5c05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 61 KB
21 KB 113ms
32ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd8d091998fa4d4d864093ce745eaa0ecc136dd2c4ad3d84fa94905b5b9775b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "896 / 472 of 1000 / last-modified: 1623111925"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21252
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:07 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 89 KB
35 KB 140ms
138ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

368affb6d9ed99faa3379138505bbc74602cd0083aa7309dc20adf505ad6fddf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35966
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 08 Jun 2021 07:01:07 GMT

GET
H3-29 200 top-back.jpg
img.sci-hub.shop/scihub/ 184 KB
185 KB 12ms
12ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/top-back.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a50dba2bfbbfe01d25c025c5ee5acb8ce80af1707fb3b50ce82ff434be6b98f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 188646
cf-request-id: 0a8c05dd4d000005e49f03d000000001
last-modified: Mon, 16 Sep 2019 12:17:02 GMT
server: cloudflare
etag: "5d7f7d3e-2e0e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2wk%2FnPxm5Yap1m7%2FHqfhl%2BDeOh8uqKg5P3rgC55LTmOtqVTVlGaNc3eWjWPXlrOtvSpTeQ1Xd83CXVJU9oWKPRfMo8Z91Cx0NnabGIf4RRyOqHyfCloIr2jj0M6qYE%2BTA66cX1WaWJ5Kkw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f421f9f05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 logo_en.png
img.sci-hub.shop/scihub/ 14 KB
15 KB 24ms
23ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/logo_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 454e4bc03b54bff4716e23ac8be68737dffd664ea64400effdc9ff4581e89586

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14556
cf-request-id: 0a8c05dd53000005e483068000000001
last-modified: Fri, 30 Nov 2018 05:56:38 GMT
server: cloudflare
etag: "5c00d116-38dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EYD%2Bf1HQDg%2B5%2BEEKPU23S7jYwehEjqGJmXKN4eZ%2B3WV0oLuGoATdhEX4C6q68c9fFNYsf8VQO%2Bxui7rSS1Wo4xd55l4%2B0kcFUg49eYLb2i5MFiWMAdozawQk0%2Fgl7Wtaprra6Jb4K3cG8w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f421fb005e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 raven_1.png
img.sci-hub.shop/scihub/ 59 KB
59 KB 25ms
24ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/raven_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c976023edd17ce89501bb6a4cd50277b50fc4ef4045d61b52854da88d36cb202

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 60144
cf-request-id: 0a8c05dd53000005e4bfa10000000001
last-modified: Fri, 30 Nov 2018 05:56:32 GMT
server: cloudflare
etag: "5c00d110-eaf0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zqAXNcT7lyoSmmgofzBLRHS6bU8WYAZy6w4RhW%2FZ5ik0vvRlla7U5ZAiNNsj6uh6YUw0VOurUClZwE%2F7dWIxvUl4DJocGyXiY4jZMGkqwUtxGDTmq18AMZkQL0Kuoz61dmCLtJMmm3NnSw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f421fb205e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 map.jpg
img.sci-hub.shop/scihub/ 54 KB
55 KB 29ms
27ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/map.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14e6508482a47b942549d487294e164dbe8684e79a6a00410dfb966acffa9570

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 55605
cf-request-id: 0a8c05dd53000005e4bba3c000000001
last-modified: Fri, 30 Nov 2018 05:56:52 GMT
server: cloudflare
etag: "5c00d124-d935"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MGnp4PhvFuAiPBnJkMcF2WkCYTwJN4M8ZI2PMEpmJs7zq5oBfVh9HX8ZsBgAEZLYPpaXzWK0lC8uBBYrlJMpfTzcedFQfEAWrdHYuwclF608cXFh9O1GfnuZAwsRKkI3MVdi6QLaECkMrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f421fb505e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 about-marker_en.png
img.sci-hub.shop/scihub/ 3 KB
4 KB 30ms
29ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/about-marker_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8e3e37a00f298198fe34abc7c237a0b3c21659f668e142dcf5bc467bae0de23

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3361
cf-request-id: 0a8c05dd54000005e49da3e000000001
last-modified: Fri, 30 Nov 2018 05:57:02 GMT
server: cloudflare
etag: "5c00d12e-d21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JlzfpFYwJ5%2FPsXTubfh0f8A%2B1UK94GMrZ%2FjB2sCbgES7BV%2FwczxF%2F6UT4qRWaH34jF3yA%2BA41yXoPE%2B6IZRbWy82ZJ7re%2FFhVE%2B8yri23FCk%2BitZ6N1Ue%2F1g4TwsXOMpZid%2FfnBXRuhaDw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f421fb905e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET AvenirLTW01-55Roman.woff2
img.sci-hub.shop/misc/fonts/ 0
0

GET
H3-29 200 quote.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 13ms
13ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quote.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f3abdf0859cf36c2821963a7266a955fd4bd5fe491f997d9d8dae3f3957cf75

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1068
cf-request-id: 0a8c05dd76000005e48d196000000001
last-modified: Fri, 30 Nov 2018 05:57:12 GMT
server: cloudflare
etag: "5c00d138-42c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=u2V1bHZipHAObMLQhDSugihDZl36RVGfAebGLnwhhQX005SHaN9In0Lvf9dO8T6lmT%2BU562rosFRqYKBLzqq4ikUaoSFrP0EpUX6Fuznem6VpgUCYPplnJ6goYF9510UZTDVW7w9S3rkqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42583f05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 quotenext_en.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 14ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quotenext_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 460b964d7227b7963094c56a6449ed520818785ccb2eb6ecfe8be595fee74232

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1087
cf-request-id: 0a8c05dd76000005e4bb31c000000001
last-modified: Fri, 30 Nov 2018 05:57:18 GMT
server: cloudflare
etag: "5c00d13e-43f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1gIUKqd5xaJ9vSrH1QvyrYHA5%2BmEbwoBpnkxrxunzvUX%2FWbQqXCtqXbWqYSRay15s%2FNPTuK1MT%2B67NOT9BoQsQyTUDSpPa1PulS380DXjCIBNBgo22EY6CmrTNzZI3%2B93PMDzkH3TUxh%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584105e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pone.png
img.sci-hub.shop/scihub/ 2 KB
2 KB 12ms
12ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pone.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44e857b78e5b61610566603bed79bceb9a60415b2795cfdf907346cb026d2450

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1637
cf-request-id: 0a8c05dd76000005e49f042000000001
last-modified: Fri, 30 Nov 2018 05:57:24 GMT
server: cloudflare
etag: "5c00d144-665"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cpmd5x54kYg8obnP0vvQBsLhDFhd6ALcdz5RGFUwrnm30UKl%2BWejPiUjneUFaeVbPQ3Tc4yrsGar36uNVDu42u5fpBTJrnS13qZ3BClA2BpNXdiFKwCWVmGEG9gKcvLbpHRkzP8srUQjVw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584305e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 ptwo.png
img.sci-hub.shop/scihub/ 4 KB
4 KB 15ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/ptwo.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c930cfd1a633df3f92e6104e291b65534f21a32f3e1fe1d4bfb3b5eb7df17c74

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3907
cf-request-id: 0a8c05dd77000005e48306d000000001
last-modified: Fri, 30 Nov 2018 05:57:30 GMT
server: cloudflare
etag: "5c00d14a-f43"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gtTGAnjQhVsCo%2BMxMwCyjOd%2BMU6DIxxKj%2FqDFuv6h3FoqILvXtwXNnFyZMm9UWHMe3vr7NwmkqjweU3qc6pk7%2BWQVbTn6Wj%2F5Aqycx71%2FSvECq%2FbmfSYpBgw3FxnejSf3TkuYjXlBMekKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584505e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pthree.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 21ms
21ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pthree.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff03fb35159e9cc4104b52e40b4153040df127e8cbeb3a7f351a4951b0008c28

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4278
cf-request-id: 0a8c05dd77000005e4a40c2000000001
last-modified: Fri, 30 Nov 2018 05:57:36 GMT
server: cloudflare
etag: "5c00d150-10b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3k261WqxSe7oPSwTjg5pzDaxZNI7iZ6g%2BPYKdbw%2Ftjz77tCXpEsCkM6YH4aBmtkeBTtU%2BjsSDX33Pt%2FmJnZFDEW2Dfji4Qa9rjdg6GMbPNBuaaqYC%2FxHYG%2FPc4VJ0GpVdjY8NS6LmzYC%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584705e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 people.jpg
img.sci-hub.shop/scihub/ 50 KB
51 KB 14ms
13ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/people.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46dcb8cb7d4d80220baa300c65817e9a4a324c15ddb1e3955d222175eb6cf8c9

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 51212
cf-request-id: 0a8c05dd77000005e486bdf000000001
last-modified: Fri, 30 Nov 2018 05:57:56 GMT
server: cloudflare
etag: "5c00d164-c80c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=opeUz2qnIwIA%2BDWplghBR6LCBGD%2FIRkCCU%2FKzzVyI6dHyvvH9iO2xGPsrBeOPUowp%2FKaeWqOLSIh55kUDEuRcNmfZs6Rn2kSUseGLz%2BBq3chMWOianbGnGQjn5%2FKhk0C5nw81xqQYc2XTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584b05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 join_en.png
img.sci-hub.shop/scihub/ 6 KB
7 KB 15ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/join_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3860c6aa1cdef6ed8bf7315bbfbdc1237d14f68ea2e7a55bcccb9e77662d1b7f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 6197
cf-request-id: 0a8c05dd78000005e4b3145000000001
last-modified: Fri, 30 Nov 2018 05:58:24 GMT
server: cloudflare
etag: "5c00d180-1835"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=PxZ8VkUWNZIs5tXuBKLS2XEy54A9NEIXCAEhnzewvY0kz44NdJvTlhNeXjsmBd7Vfbx%2B%2Bk5tJSfTqHadqdXdi%2FLoMlaSqGXd4915Ma%2FCK1PGSW5EGqBOeP2vQxG%2BqrDL6Ban6iwMBDFVrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42584f05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinvk.png
img.sci-hub.shop/scihub/ 17 KB
18 KB 19ms
18ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinvk.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c065fb78b0e08dfcca754d46f64414bff72a17836b5da8f717e48423fd4e5952

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 17834
cf-request-id: 0a8c05dd78000005e4920b9000000001
last-modified: Fri, 30 Nov 2018 05:58:30 GMT
server: cloudflare
etag: "5c00d186-45aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=NfeSBhJPGAj1cbsUkS1fpwtvni2V%2FC4bcaxldRX6cHUkvgWC1qnaIm%2FhG6VrZqxtKXdrOYXHbhIB13eQGf9rH7lDEzetvQlqTfS%2FaNZiDdkj7qOOpZbxqX1w%2FXu37mQUArXW%2BqzRXDFjGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42585205e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 jointwitter.png
img.sci-hub.shop/scihub/ 6 KB
6 KB 16ms
16ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/jointwitter.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f6720f9b1b728e80c6f618a5aac450c6f6df834dd8f0e8b4059ac78a90af7af

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 5751
cf-request-id: 0a8c05dd78000005e4773ac000000001
last-modified: Fri, 30 Nov 2018 05:58:42 GMT
server: cloudflare
etag: "5c00d192-1677"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=u9OMDafazUZcYg7m0AO1oggPKQfDQr6%2F5Q0fukNQi8g5iuje3z63EMKXp8Hsi3ftGmstcLHYxK1H1lqxUZ7GWtfnfGQKGRYj9NqSs4h4fEk0MIr4KFJg4X572%2BeohTbhEch6iB8NFnZmiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42585305e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinfacebook.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 14ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinfacebook.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dabaf1eee4ae1c1db524c66d6950221386ef064a71d29b9f799d1905d64456b6

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4152
cf-request-id: 0a8c05dd78000005e4bba40000000001
last-modified: Fri, 30 Nov 2018 05:58:36 GMT
server: cloudflare
etag: "5c00d18c-1038"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5VibDDkXcuSaoAWFQcRPW2VC3G4ntnXU4CL7AevyqTca3QvPYAMBJF0W%2FrZjpCoFizUiZdLkyJaHXb%2BDq91niR15Ao%2FtLp7CP%2FxaoLwyiMidQut74k7pjr7hUs1bPnrzkyUI0woqXgbNiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c03f42585405e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pluso-like.js Show response
img.sci-hub.shop/scihub/ 41 KB
12 KB 18ms
18ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/pluso-like.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 125ef9e8cac071be547016f215e726b1f17be04068441bb35847bf565c89e4c3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 257230
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8c05ddb3000005e49b9c0000000001
last-modified: Fri, 30 Nov 2018 04:39:20 GMT
server: cloudflare
etag: W/"5c00bef8-a5cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AC%2FF0N4PCimsV5oIyHqwz5Vv4qqjKLtQvDKP4Yp%2F4hbmraXQY94W2dY2tPizBEcYRWnRzvNBNbwJ5Q4U55TWXP2gqYHaA9z3elxjr3%2BgaqX0LYP50N06pwYCiiWbQYHx3v31gopRjuZ52Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c03f42b96205e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pubads_impl_2021060301.js Show response
securepubads.g.doubleclick.net/gpt/ 312 KB
109 KB 73ms
32ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0b3850a417ef733c6acaff02a3311c7ce9a5b7ee55d2cd76d8c7f1f661bcb20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 08:37:25 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112073
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:07 GMT

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 6001
date: Tue, 08 Jun 2021 05:21:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Tue, 08 Jun 2021 07:21:06 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1535676908&t=pageview&_s=1&dl=https%3A%2F%2Fsci-hub.mksa.top%2F&ul=en-us&de=UTF-8&dt=Sci-Hub&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1205020002&gjid=1198910646&cid=212601436.1623135668&tid=UA-193456449-1&_gid=554117063.1623135668&_r=1&gtm=2ou621&z=1926323148

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
443 B 42ms
15ms XHR
text/plain 2a00:1450:400c:c01::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-193456449-1&cid=212601436.1623135668&jid=1205020002&gjid=1198910646&_gid=554117063.1623135668&_u=YEBAAUAAAAAAAC~&z=319451943

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c01::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 08 Jun 2021 07:01:07 GMT
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
799 B 49ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 36ms
16ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 07:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 980ms
979ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4260403759491277&correlator=3231987408622639&output=ldjh&impl=fifs&eid=31061359%2C31060890&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2C970X90-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1623135667&dt=1623135667832&dlt=1623135667440&idt=365&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=900&adks=1836978441&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x0&msz=970x-1&ga_vid=212601436.1623135668&ga_sid=1623135668&ga_hid=1535676908&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bacf762681b49615960abc2284739d1c227795b55247b3aadb75143c4b46603a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8126
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 48ms
14ms Other
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 1432ms
1431ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4260403759491277&correlator=3231987408622639&output=ldjh&impl=fifs&eid=31061359%2C31060890&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2C336X280-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=336x280&cookie_enabled=1&bc=31&abxe=1&lmt=1623135667&dt=1623135667838&dlt=1623135667440&idt=365&frm=20&biw=1600&bih=1200&oid=3&adxs=632&adys=1552&adks=2992418410&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=528x334&msz=336x-1&ga_vid=212601436.1623135668&ga_sid=1623135668&ga_hid=1535676908&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33a39c2a59e36b01a8bb3debe0884dfd30e4a55bbadfff0b6d304703e55dbe92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8942
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 472 B
284 B 1676ms
1675ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4260403759491277&correlator=3231987408622639&output=ldjh&impl=fifs&eid=31061359%2C31060890&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2Czsy-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623135667&dt=1623135667840&dlt=1623135667440&idt=365&frm=20&biw=1600&bih=1200&oid=3&adxs=426&adys=2192&adks=1528813087&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=212601436.1623135668&ga_sid=1623135668&ga_hid=1535676908&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

500a99e25401d45e8434e4fd083cbe6c855b43f280e843f44b5890652ee4996a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 254
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 477 B
288 B 1143ms
1143ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4260403759491277&correlator=3231987408622639&output=ldjh&impl=fifs&eid=31061359%2C31060890&vrg=2021060301&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2Czsy-youtu01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623135667&dt=1623135667841&dlt=1623135667440&idt=365&frm=20&biw=1600&bih=1200&oid=3&adxs=430&adys=2192&adks=3809152490&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=212601436.1623135668&ga_sid=1623135668&ga_hid=1535676908&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

6a716699aebda0947c3db7177a7c6810447440249bc29052545efb32ad5ae014

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 222ms
56ms Script
application/javascript 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=gpxJVX2693TOolLX&first=1

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

03275db33f0d4b63b93e8ef6e162a368574b26fb11ac0af3c59b2c38935726b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 224ms
56ms Script
application/javascript 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=vPo9v31ZBX48undefinedqdy

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

03275db33f0d4b63b93e8ef6e162a368574b26fb11ac0af3c59b2c38935726b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

hit;PLUSO
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

43 B
496 B

70ms
70ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host210.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:08 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 07 Jun 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:08 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sun, 07 Jun 2020 21:00:00 GMT

GET
H/1.1 200
OK 06.png
share.pluso.ru/img/pluso-like/square/medium/ 23 KB
23 KB 261ms
94ms Image
image/png 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/pluso-like/square/medium/06.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

a88d699bbf9f25fa9a614e4af43982e1096bd9f918a3f5adcaace243ae5cfebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-5b8f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 23439
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK plus.png
share.pluso.ru/img/ 2 KB
3 KB 225ms
55ms Image
image/png 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/plus.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

784eb14774a9a419af32c02c2d16cf197ef2701afc2ea65b58c3a574ed5458bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-98a"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 2442
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK kb.js Show response
kitbit.net/ 1 KB
2 KB 598ms
58ms Script
application/javascript 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/kb.js

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

7010b495134f89ad034ed591f360e394d1e4a2f8abc1410756591d76d41f4105

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:59:34 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC/FVaESQsqT5EOAg==
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=21600, private
Connection: keep-alive
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 12:59:34 GMT

GET
H/1.1 200
OK adcm.js Show response
tag.digitaltarget.ru/ 3 KB
3 KB 176ms
58ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/adcm.js
Requested by: Host: kitbit.net
URL: https://kitbit.net/kb.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7c078e5032ba5da0fdf4e333ac30ad283aaa9de5d935e716c6fd7e1b5d4e9d2e

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
Last-Modified: Thu, 13 May 2021 10:40:41 GMT
Server: nginx
ETag: "609d0229-c11"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3089

GET
H/1.1 200
OK s.js Show response
kitbit.net/ 1 B
303 B 60ms
59ms Script
application/javascript 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/s.js?u=https%3A%2F%2Fsci-hub.mksa.top%2F

Requested by

Host: kitbit.net
URL: https://kitbit.net/kb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:59:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 06:59:34 GMT

GET
H/1.1 200
OK h.gif
kitbit.net/ 43 B
537 B 118ms
58ms Image
image/gif 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kitbit.net/h.gif?r=&s=1600*1200*24&u=https%3A//sci-hub.mksa.top/&h=Sci-Hub%26kbuid%3D5EFC831F5615BF602A0B4984020E914F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:59:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC/FVeESQsqT5EPAg==
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=0, private, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 06:59:35 GMT

GET
H2

200

cro
optinder.com/
Redirect Chain

https://p1.ntvk1.ru/nps
https://optinder.com/cro

0
559 B

56ms
37ms

Image
application/octet-stream

2606:4700:3035::ac43:c8d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optinder.com/cro
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c8d3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=X2SEo%2BcZwW7XAiEl5Uef6Nbv7aOVHMpSRca7tlsIfE1ZvkfCi8UasdMQDnyhIQ2EsR2B%2F7hIAyLbekpAa1maZB52%2FMvqk%2FFTyeN7AFjxWERtVloDPHVTVksNTrs3nC9deFqPQAWu"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cf-ray: 65c03f48dfa84e26-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a8c05e18b00004e2647985000000001

Redirect headers

x-77-nzt: AcO1ryw9M4OB
date: Tue, 08 Jun 2021 07:01:08 GMT
last-modified: Tue, 08 Jun 2021 07:01:07 GMT
server: CDN77-Turbo
x-77-nzt-ray: aLVKhS3Jgpo=
x-77-cache: MISS
content-type: text/html; charset=UTF-8
location: //optinder.com/cro
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, post-check=0, pre-check=0
x-cache: MISS
x-77-pop: frankfurtDE
content-length: 0
x-request-id: 1235254513-1-1623135668.571
expires: Tue, 08 Jun 2021 07:01:07 GMT

GET
H/1.1 200
OK sud
ut9.rktch.com/ 88 B
88 B 194ms
65ms Image
image/png 89.108.97.2
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ut9.rktch.com/sud
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 89.108.97.2 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: d50603.reg.regrucolo.ru
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 88
Content-Type: image/png

GET
H/1.1 200
OK processor.js Show response
tag.digitaltarget.ru/ 15 KB
16 KB 101ms
101ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/processor.js?i=881769817481593
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5a0da3f86d0505c67db1fb2287ce92548014d4ba7969eb76b7f716a5d5009e8f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-3da5"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15781

GET
H/1.1 200
OK extension_1086.js Show response
tag.digitaltarget.ru/extensions/ 732 B
976 B 57ms
57ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/extensions/extension_1086.js?i=583631664015200
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: acde19dd39fd4b3b76819f21d622af86dcdf0cb00967a337a01005e8316ccb1f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:08 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-2dc"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 732

GET
H3-29 200 container.html Show response
d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DDEA 6 KB
3 KB 20ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 07:01:07 GMT
expires: Wed, 08 Jun 2022 07:01:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 33ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066164336645"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:08 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 37ms
18ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec1abaa71748ff611ed108e487b30869570642b08583e77d7c053f5999cdacd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7925
x-xss-protection: 0

GET
H/1.1

204
No Content

i
dmg.digitaltarget.ru/1/7199/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc
https://dmg.digitaltarget.ru/1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc&q=scc

0
398 B

61ms
60ms

Image
text/plain

185.15.175.130
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmg.digitaltarget.ru/1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc&q=scc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.130 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

Redirect headers

Location: /1/7199/i/i?i=130941833992772.749461404168669&c=tg:adcm_pc&q=scc
Date: Tue, 08 Jun 2021 07:01:08 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

i
dmg.digitaltarget.ru/1/6533/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/6534/i/i?i=130941833992772.597120116606310&c=tg:adcm_pc
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=130941833992772.597120116606310&c=tg:adcm_pc
https://fnc.rt.ru/1/6532/i/i?i=m7puf0RXlgsH8A77c2x7&c=tg:rds_6534
https://fnc.rt.ru/1/6532/i/i?i=m7puf0RXlgsH8A77c2x7&c=tg:rds_6534&q=scc
https://dmg.digitaltarget.ru/1/6533/i/i?i=9643001586998176787000000018458612&a=774&e=hE3Ln6moi53_5555KtFc

49 B
602 B

81ms
80ms

Image
image/gif

185.15.175.130
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmg.digitaltarget.ru/1/6533/i/i?i=9643001586998176787000000018458612&a=774&e=hE3Ln6moi53_5555KtFc

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.15.175.130 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),

Reverse DNS

Software

nginx /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Request-Time: 8
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 64
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Credentials: true

Redirect headers

Location: https://dmg.digitaltarget.ru/1/6533/i/i?i=9643001586998176787000000018458612&a=774&e=hE3Ln6moi53_5555KtFc
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://fnc.rt.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cm.gif
ad.mail.ru/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=130941833992772.456412868242897&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=130941833992772.456412868242897&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:d...
https://ad.mail.ru/cm.gif?p=61&id=WRmmG8HXhos0WBc7c3ag

43 B
635 B

135ms
45ms

Image
image/gif

2a00:1148:db00::17
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.mail.ru/cm.gif?p=61&id=WRmmG8HXhos0WBc7c3ag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a00:1148:db00::17 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:09 GMT
Last-Modified: Tue, 08 Jun 2021 07:01:09 GMT
Server: nginx
Content-Type: image/gif
Cache-Control: max-age=21600
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43
Expires: Tue, 08 Jun 2021 13:01:09 GMT

Redirect headers

Date: Tue, 08 Jun 2021 07:01:09 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://ad.mail.ru/cm.gif?p=61&id=WRmmG8HXhos0WBc7c3ag
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: master-only
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Connection: keep-alive
Request-Time: 8
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H/1.1

200
OK

i
dmg.digitaltarget.ru/1/6431/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=130941833992772.871322338837147&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:du6GdiDyc4lmiy5APGoIjNCU.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=130941833992772.871322338837147&a=86&e=5EFC831F5615BF602A0B4984020E914F&c=ss:86.up:5EFC831F5615BF602A0B4984020E914F.sync:up.xdua:d...
https://amberdata-sync.rutarget.ru/sync
https://dmg.digitaltarget.ru/1/6431/i/i?a=711&e=Oc_97iUK473-&i=0&c=up:Oc_97iUK473-.ss:711

49 B
604 B

203ms
203ms

Image
image/gif

185.15.175.130
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmg.digitaltarget.ru/1/6431/i/i?a=711&e=Oc_97iUK473-&i=0&c=up:Oc_97iUK473-.ss:711

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.15.175.130 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),

Reverse DNS

Software

nginx /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 07:01:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Request-Time: 112
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 64
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Credentials: true

Redirect headers

Location: https://dmg.digitaltarget.ru/1/6431/i/i?a=711&e=Oc_97iUK473-&i=0&c=up:Oc_97iUK473-.ss:711
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AF6B 624 B
597 B 16ms
16ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKr0m6wBMAE&v=APEucNV-MX3MLkg_VGyf8Mx_Z5NzV3BjNf53YrdrR4KPSOtlvihWAu0kP_OHgv4ARpvlvTURh6J8BnCZhfQhlH0qzWMndIq8u5QRzU6lLUJM6Oz6cFimJxpfuvY9A2Lk-V0cY_vrl8E5B1zDCQT-lzz2_JAIAW2C_NsG4hStKHrcqDuUMmA8eX0

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKfiYRCX9ucBGKr0m6wBMAE&v=APEucNV-MX3MLkg_VGyf8Mx_Z5NzV3BjNf53YrdrR4KPSOtlvihWAu0kP_OHgv4ARpvlvTURh6J8BnCZhfQhlH0qzWMndIq8u5QRzU6lLUJM6Oz6cFimJxpfuvY9A2Lk-V0cY_vrl8E5B1zDCQT-lzz2_JAIAW2C_NsG4hStKHrcqDuUMmA8eX0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 07:01:08 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlgFbGXZA4_iUM4UuWobiYCxuDCmmAr8_JhbZV3iNt8HwWPXyUyHFEqSX9N; expires=Sun, 03-Jul-2022 07:01:08 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Jun 2021 07:01:08 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A273 58 KB
24 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D0AoWBV_XbbTARrZ7sGgNlLRsIciahnVGoCQSm8LvgNM0nWyrpve_pF_8Rv90bfj8t0SH5D5HqK1b_l23mBxUxo9PDpqC4lPcxZAeb7g2TtTW2o2p185q2h5FZdUKtun11QlCs5EayEiHOfVmFxuOZikX6JQ&dbm_d=AKAmf-CHZRLGtXTo_6-iepjsoBaeSC6LxEOOI14aQ2v34Y_3DqHrzoEGZpsljYs8w_rKYusPOxBH6kXaVSrKwkouj0W6ybKBU3z-ZmrlaCNiBD_8m9dwcqewHp1qh4356uMjpD8ETXshxvHLd0-Ls8yr1kdXj_W0LwAdtk0Vyyh2hFI5dSZWty1aAZCpXqvRiMKgDErbIGXngy6766d5rxJtF3SoTs6PPJvCC3P_G9JDOYTUIEKACJ8y3NvESqh81km-P9SXhHJ1YxKCu_h-sBpON0e-ZD5AMAJgX6xCHWkrjKvhnrKOWPZHSVRb_MDEjqXyx-QlE_SO-oVwfzTWiNXk5NM1e5EUABByqSejUuHRIP_shPY-rye9fT3FBE7XwyQbjpHvwcHd6MA7WAAha4j0DpkF-KYhg80Pc10bw93hAQlLzRgfl5XBTK5tzVd3Kzyi8hSRyG2YLqM0pGIaocpXtLauPdv1IpU3VicmtDLkFg-cpKRSaKy9ZxUMHTNVDOJq99tnr-N8QSAR-qh3z_lOac3Tt_cBhcRfv7PYAOm7pcHddmQoujX_-7eIGwQI1aJM2Fk_zr4y2v52uYKsiLfiBFiTnjZf2zpU41uAEn3yRrEcD58UeH3pEXtnRYdkJXoVCHTIt-ATmCTdgeX_RPqrmf8eJV6iFk-3a278ptegdHw1qZId75vS2e5oTntcTcdiqN6AhgLJozO5WoKtAnOTdxQHEVlvjJyHaZxQW2_ZmnxkwRl0m0VOcEt5EsAxShVGIKvFqcCsVlBocG4RSizkaNScJKdy_dR3BTaZV8Escji4wOEYm2yLDstwQI9x-qrsGF3xNRUCW5NVQCsfiQDrJkAm-GMj1lqrakykqSSRPGnVAr7Vx70fngHoXex5Xjg-Ll0XtC7bc8bYVUjqPpwK3u4mdG6du6bxUHYqNzDwGXiWfvsGRHj5l0JeqPQ_LGWy3siP3w0sx0K6TUHwVxNdnj3XBLden0QzQqwpuei5CeumI_uI7cjS-yQHSepZZdl4aQDuuaUzPvd8XeHhUqe5Rr8vH-_1YP9c9_dr1n2P_Fe19FYez9jmGEmuCh9EhyC2kWFQGwKNFRF8f-aJaBL7-YuRnkeuFwcxg9MXFbhaVg-SK0kSEgc2dox4Oaw36bN_liohwMpBUXAQaYcQqpNAeI8EpiXELvcCrtOkBZ4agxSDy7n52amA9kFCC2h9mB2rOxZL6AoQ9PuF6Icb28h2R3QuQxXn5UBiZmfgG7fE05f8iJ57nIQsDGAZFLiNIjTdV2VTCJSSsdNMtAQjdSwl60E60q2nQQOEeDhBClB4XcPcN1EDpRFAAkZi7ELsFYZTgQHctqDMqiFWW08UvVXj4R4ibn4grC-1IC3nPwtEs4PnF1UUSR_fBjLqYl5xuzp8vfpj-GtxtHzt7ETYHUFIYOC1a0fwvVPxVjVmC8xQabTVGhjA_U23Kl26FS1j4gv670N8VK0xIrUlfPGX7Et_AgJuKLKPrlgTVNMOmj_5B83xQFA-ueDuG6zjkZXQbqVoNcbNIWJKhSV-ImKT39KM4by9jdtbydFpCKBcva_ayBAfxsAnwFILQG7d_tW9apWi6Kx-nZ5cirQTo8pY7yk53crqRRjx07Tb-gQhLIfMzly6E9JvYyS9dmZWlPYdyNzsZUiv1bJAPPCbGLegwtNdPNGubO3VsGLJbkY2-AOnbP2K15NradegaNLAcZdnEFt5F5gqMw4GeuehOpGB5UFlDZGyHGzSIPBp3pz8w93URjKFmDIbhTe_IpJH4plnFgWngL_I_zjLDaBd41_GPxanwP1UeTPHP5iRTYuBPWSn_P6DAF4OIV94NCqM7bcsZi_VeUFrCKkZ1eWmSYQKKOaK9VYosF2JMQI1mZ9nR9VeSoVope4kTMMFyRzSoGlTC5EdwqJ6QoT2j9xNCSveCohDs0ALC_wIWM-eUA6Nk2BaD3kw65PtDpcNE9PgUeZenHF3eRWFrF92E1vefSzJXcN_gSLKL6LnmP-fena0pTeL7kfMevh7J2MIJcHI_NlaCyG_9gsykocJz2bPgpM8cvmY2yZ4uHL3ZMizG64-f_uZuK2QF-tpAamZ1uS40cAJS_0ZH_bLqgdw3Ey8b1G-HufL1zGbjqHu7NSq8guL25Se1YxE4d5dq3OIGkNAYuCZYl5fs21kSg98LjzyJ1ArUo2XACyB7bqxjZkRftBgIbwlcOWksQ_umX83ysryrhHbAHnfnjF1ZLO29K3eOihx1_RsxKwfsA2bGqRcxH6_aNUPAUFg9oSTboBjjSp6Iddw4bFsSMiEo7Q0EHDVHCALfPh3yHccU1R4hlbs6xkqBUK6x_jr-kZ-1tanhJwZ-Tt2EA02cfbP2kRDZWjSKVdqOxnPN0pBcULb87xqr-2EsqRVa2qgkaYE2fu1ublvgmWrnJbWoJ5oH977e-kDOFDr5xN1gfor_QuTV6ZsOMFRXyxZoocOk3Gno_wrRU27vg3LP6pvnEkqTHAmMFsJFUAEREY0w3uxV6FBklfaFluek9Ik2-Yz_Fv_XqowsD55u2NLOwwL-S2DFILdJTzrsDcZPCwLzdlyJwzV2e4f7iBEpe5-HIF-AHRkzq32ptto6IFGbI2I56YAaZ7lYEV_iq_NRtLZHOdNGPURjGUO1FIWZRiATVq4lknQO-RrxgJzf8zFqsA628bGc95zS7CWqUYLaI4EtkLIwQll6KYzxrsb_zmJUzwoRRwlLelwlFL7ZM0hSbHbTOS_Q0bmNf6YIzYO621wpRgMdEYfFqhLTgKvV2kvaSrYTwb_x10p2ubsZWMeImdb7tASQoE_F1x5IIuLJuGnXsNmqHQ6cbaEw5TqcBELzdPYYco80oMcm0WABL7oGFz8JBhv4tKVKwGTdX5XC22zwMEoeth3Y965yrQ4m-s4XY6NLZyLa4PIe7XACwMgRCEe_I9o6XyyxVd5YcOKHKp_34McRCJzxfC864nTVBluMYsgS5aoD46Ho0B_sF2dK2DJHHY-KAESbDQDqZnVPYIhHf8OxL6Q8fAl1p0Q6Vz-cVsb1k0TWECScpxn6hojdXZ8EpcJmPpWfOaxtX3w-BodcsoZAg3ioJCSOEpKB6BQW4-Y76-9AH0&cid=CAASFeRo5wdZa3gCLzpPa74jkvVROzo6Gg&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d870d5a4ec15a6834621a5f4fd0d121f430c9f9ea0e4e0fa150b3967046260fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24664
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame A273 2 KB
2 KB 31ms
5ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 94
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:59:34 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A273 122 KB
37 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:08 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame A273 13 KB
6 KB 32ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:57:43 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A273 0
0 14ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSK_veHDIYTY7dGAiQlmpAlCdPppuxG7qfhhg341KUWkOl65TU9ggsInC_CIimUZ9b-kZCQpY5VEb3xKZf-PcxvVQfiRQ
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A273 42 B
498 B 57ms
39ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CIJhd0njOecvdVXsQAB38KaE6JGYUoE0IVUdnEcJP-0zO9WiqybwDUxKyAIhYSRPd97ojm78u4Ks6VE2uMgdVZdwTzD2Lv0rLM5jwltIeLJYmCC5M

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:08 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AF6B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1&C=1

43 B
1014 B

45ms
43ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKr0m6wBMAE&v=APEucNV-MX3MLkg_VGyf8Mx_Z5NzV3BjNf53YrdrR4KPSOtlvihWAu0kP_OHgv4ARpvlvTURh6J8BnCZhfQhlH0qzWMndIq8u5QRzU6lLUJM6Oz6cFimJxpfuvY9A2Lk-V0cY_vrl8E5B1zDCQT-lzz2_JAIAW2C_NsG4hStKHrcqDuUMmA8eX0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 07:01:09 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPDBdyRxjVdhhECyK5uXXmo&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AF6B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8VtTrLbBdlQ7v5EtfY2wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

43 B
894 B

255ms
254ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKr0m6wBMAE&v=APEucNV-MX3MLkg_VGyf8Mx_Z5NzV3BjNf53YrdrR4KPSOtlvihWAu0kP_OHgv4ARpvlvTURh6J8BnCZhfQhlH0qzWMndIq8u5QRzU6lLUJM6Oz6cFimJxpfuvY9A2Lk-V0cY_vrl8E5B1zDCQT-lzz2_JAIAW2C_NsG4hStKHrcqDuUMmA8eX0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:10 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 07:01:10 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:10 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame AF6B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHjsfdIqerEpfZNZSqDlx10&google_cver=1

43 B
1021 B

118ms
73ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHjsfdIqerEpfZNZSqDlx10&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGKr0m6wBMAE&v=APEucNV-MX3MLkg_VGyf8Mx_Z5NzV3BjNf53YrdrR4KPSOtlvihWAu0kP_OHgv4ARpvlvTURh6J8BnCZhfQhlH0qzWMndIq8u5QRzU6lLUJM6Oz6cFimJxpfuvY9A2Lk-V0cY_vrl8E5B1zDCQT-lzz2_JAIAW2C_NsG4hStKHrcqDuUMmA8eX0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.234:80
AN-X-Request-Uuid: eac0d297-697a-4473-9b69-81a13d9abdc9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHjsfdIqerEpfZNZSqDlx10&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame AF6B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

170 B
188 B

64ms
33ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.79:80
AN-X-Request-Uuid: 87297c5b-39fb-428b-9326-3b19480b5437
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame B6F3 12 KB
5 KB 20ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Tue, 08 Jun 2021 06:56:43 GMT
expires: Wed, 08 Jun 2022 06:56:43 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 265
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame AE84 783 B
533 B 31ms
16ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c99836dab7d83a2e6f0f46dd80cf5cf4105cc96ba11699aa71d8741e4371eb79

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X71mIjQp5RlEGWFr6v6SaQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

expires: Tue, 08 Jun 2021 07:01:08 GMT
date: Tue, 08 Jun 2021 07:01:08 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-X71mIjQp5RlEGWFr6v6SaQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame A273 111 KB
39 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 19:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42963
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Jun 2021 19:05:05 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame A273 8 KB
3 KB 20ms
7ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D0AoWBV_XbbTARrZ7sGgNlLRsIciahnVGoCQSm8LvgNM0nWyrpve_pF_8Rv90bfj8t0SH5D5HqK1b_l23mBxUxo9PDpqC4lPcxZAeb7g2TtTW2o2p185q2h5FZdUKtun11QlCs5EayEiHOfVmFxuOZikX6JQ&dbm_d=AKAmf-CHZRLGtXTo_6-iepjsoBaeSC6LxEOOI14aQ2v34Y_3DqHrzoEGZpsljYs8w_rKYusPOxBH6kXaVSrKwkouj0W6ybKBU3z-ZmrlaCNiBD_8m9dwcqewHp1qh4356uMjpD8ETXshxvHLd0-Ls8yr1kdXj_W0LwAdtk0Vyyh2hFI5dSZWty1aAZCpXqvRiMKgDErbIGXngy6766d5rxJtF3SoTs6PPJvCC3P_G9JDOYTUIEKACJ8y3NvESqh81km-P9SXhHJ1YxKCu_h-sBpON0e-ZD5AMAJgX6xCHWkrjKvhnrKOWPZHSVRb_MDEjqXyx-QlE_SO-oVwfzTWiNXk5NM1e5EUABByqSejUuHRIP_shPY-rye9fT3FBE7XwyQbjpHvwcHd6MA7WAAha4j0DpkF-KYhg80Pc10bw93hAQlLzRgfl5XBTK5tzVd3Kzyi8hSRyG2YLqM0pGIaocpXtLauPdv1IpU3VicmtDLkFg-cpKRSaKy9ZxUMHTNVDOJq99tnr-N8QSAR-qh3z_lOac3Tt_cBhcRfv7PYAOm7pcHddmQoujX_-7eIGwQI1aJM2Fk_zr4y2v52uYKsiLfiBFiTnjZf2zpU41uAEn3yRrEcD58UeH3pEXtnRYdkJXoVCHTIt-ATmCTdgeX_RPqrmf8eJV6iFk-3a278ptegdHw1qZId75vS2e5oTntcTcdiqN6AhgLJozO5WoKtAnOTdxQHEVlvjJyHaZxQW2_ZmnxkwRl0m0VOcEt5EsAxShVGIKvFqcCsVlBocG4RSizkaNScJKdy_dR3BTaZV8Escji4wOEYm2yLDstwQI9x-qrsGF3xNRUCW5NVQCsfiQDrJkAm-GMj1lqrakykqSSRPGnVAr7Vx70fngHoXex5Xjg-Ll0XtC7bc8bYVUjqPpwK3u4mdG6du6bxUHYqNzDwGXiWfvsGRHj5l0JeqPQ_LGWy3siP3w0sx0K6TUHwVxNdnj3XBLden0QzQqwpuei5CeumI_uI7cjS-yQHSepZZdl4aQDuuaUzPvd8XeHhUqe5Rr8vH-_1YP9c9_dr1n2P_Fe19FYez9jmGEmuCh9EhyC2kWFQGwKNFRF8f-aJaBL7-YuRnkeuFwcxg9MXFbhaVg-SK0kSEgc2dox4Oaw36bN_liohwMpBUXAQaYcQqpNAeI8EpiXELvcCrtOkBZ4agxSDy7n52amA9kFCC2h9mB2rOxZL6AoQ9PuF6Icb28h2R3QuQxXn5UBiZmfgG7fE05f8iJ57nIQsDGAZFLiNIjTdV2VTCJSSsdNMtAQjdSwl60E60q2nQQOEeDhBClB4XcPcN1EDpRFAAkZi7ELsFYZTgQHctqDMqiFWW08UvVXj4R4ibn4grC-1IC3nPwtEs4PnF1UUSR_fBjLqYl5xuzp8vfpj-GtxtHzt7ETYHUFIYOC1a0fwvVPxVjVmC8xQabTVGhjA_U23Kl26FS1j4gv670N8VK0xIrUlfPGX7Et_AgJuKLKPrlgTVNMOmj_5B83xQFA-ueDuG6zjkZXQbqVoNcbNIWJKhSV-ImKT39KM4by9jdtbydFpCKBcva_ayBAfxsAnwFILQG7d_tW9apWi6Kx-nZ5cirQTo8pY7yk53crqRRjx07Tb-gQhLIfMzly6E9JvYyS9dmZWlPYdyNzsZUiv1bJAPPCbGLegwtNdPNGubO3VsGLJbkY2-AOnbP2K15NradegaNLAcZdnEFt5F5gqMw4GeuehOpGB5UFlDZGyHGzSIPBp3pz8w93URjKFmDIbhTe_IpJH4plnFgWngL_I_zjLDaBd41_GPxanwP1UeTPHP5iRTYuBPWSn_P6DAF4OIV94NCqM7bcsZi_VeUFrCKkZ1eWmSYQKKOaK9VYosF2JMQI1mZ9nR9VeSoVope4kTMMFyRzSoGlTC5EdwqJ6QoT2j9xNCSveCohDs0ALC_wIWM-eUA6Nk2BaD3kw65PtDpcNE9PgUeZenHF3eRWFrF92E1vefSzJXcN_gSLKL6LnmP-fena0pTeL7kfMevh7J2MIJcHI_NlaCyG_9gsykocJz2bPgpM8cvmY2yZ4uHL3ZMizG64-f_uZuK2QF-tpAamZ1uS40cAJS_0ZH_bLqgdw3Ey8b1G-HufL1zGbjqHu7NSq8guL25Se1YxE4d5dq3OIGkNAYuCZYl5fs21kSg98LjzyJ1ArUo2XACyB7bqxjZkRftBgIbwlcOWksQ_umX83ysryrhHbAHnfnjF1ZLO29K3eOihx1_RsxKwfsA2bGqRcxH6_aNUPAUFg9oSTboBjjSp6Iddw4bFsSMiEo7Q0EHDVHCALfPh3yHccU1R4hlbs6xkqBUK6x_jr-kZ-1tanhJwZ-Tt2EA02cfbP2kRDZWjSKVdqOxnPN0pBcULb87xqr-2EsqRVa2qgkaYE2fu1ublvgmWrnJbWoJ5oH977e-kDOFDr5xN1gfor_QuTV6ZsOMFRXyxZoocOk3Gno_wrRU27vg3LP6pvnEkqTHAmMFsJFUAEREY0w3uxV6FBklfaFluek9Ik2-Yz_Fv_XqowsD55u2NLOwwL-S2DFILdJTzrsDcZPCwLzdlyJwzV2e4f7iBEpe5-HIF-AHRkzq32ptto6IFGbI2I56YAaZ7lYEV_iq_NRtLZHOdNGPURjGUO1FIWZRiATVq4lknQO-RrxgJzf8zFqsA628bGc95zS7CWqUYLaI4EtkLIwQll6KYzxrsb_zmJUzwoRRwlLelwlFL7ZM0hSbHbTOS_Q0bmNf6YIzYO621wpRgMdEYfFqhLTgKvV2kvaSrYTwb_x10p2ubsZWMeImdb7tASQoE_F1x5IIuLJuGnXsNmqHQ6cbaEw5TqcBELzdPYYco80oMcm0WABL7oGFz8JBhv4tKVKwGTdX5XC22zwMEoeth3Y965yrQ4m-s4XY6NLZyLa4PIe7XACwMgRCEe_I9o6XyyxVd5YcOKHKp_34McRCJzxfC864nTVBluMYsgS5aoD46Ho0B_sF2dK2DJHHY-KAESbDQDqZnVPYIhHf8OxL6Q8fAl1p0Q6Vz-cVsb1k0TWECScpxn6hojdXZ8EpcJmPpWfOaxtX3w-BodcsoZAg3ioJCSOEpKB6BQW4-Y76-9AH0&cid=CAASFeRo5wdZa3gCLzpPa74jkvVROzo6Gg&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:59:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:59:49 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/ Frame A273 22 KB
8 KB 17ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5975f21c81bda9dfd465bc96ee93a336e22d160bed0054ef916a8392d5aa406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 205
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 12295082536333688880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:57:43 GMT

GET
H3-29 200 6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js Show response
pagead2.googlesyndication.com/bg/ Frame B6F3 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8047292d138b4f46fbe8493b4feed7d0e7777ffb56b3cc7ca0c7131ee9fe21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 11:08:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 157974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5749
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 11:08:14 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A273 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:20:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2455
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:20:13 GMT

GET
DATA 200
OK truncated
/ Frame A273 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 286839d447cffe9b5c46d0bf2f25462e291ac384db3f35bfa0c4e6da5002bb85

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7A88 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 07 Jun 2021 21:53:56 GMT
expires: Tue, 07 Jun 2022 21:53:56 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 32833
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatad.js Show response
z.moatads.com/havasfrorangedcmdisplay758646212611/ Frame A273 312 KB
105 KB 94ms
29ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dffdd9b6e2957c7e83d586fe8f76e2dafa3855acfdb1cda8c9098074f5127c2a

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 09:53:51 GMT
server: AmazonS3
x-amz-request-id: 10TX8TBX4DP7TEQ1
etag: "42d45703fd6788947b8ec6e1fd17e452"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=27411
accept-ranges: bytes
content-length: 107119
x-amz-id-2: 9lOWYX8W8RiqMNCZsjHkRL8RJyS3WgNG0DZm6NZUREcgLyBJBAl6Iwg2pjbvmgalqFXsvO3iSro=

GET
H3-29 200 index.html Show response
s0.2mdn.net/8364841/1622810317644/ Frame FC77 7 KB
3 KB 20ms
6ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364841/1622810317644/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df1f916d32680736198e3fa4a2886e094457e87ebb6fa4cd8997fbe368e0ddb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8364841/1622810317644/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2813
date: Mon, 07 Jun 2021 09:40:45 GMT
expires: Tue, 08 Jun 2021 09:40:45 GMT
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 76824
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A273 0
255 B 74ms
67ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstqW2zrmLaWtLU9ZOTukpFjG-3T9lfI0pQaa_gEkaM6WkBs4OoMA0mtbB26HD7SZRmhb5t_8BfPrqkLwtznZ_3s6-VGdKdzkAplAhSMf7pPukBoA-PiPPiwe0jH1f64TXJT96a2ThwvsWjRSRBdDkNAZJIaAkw75tetoag_WV-5vaUuW9G9RhV0IsxhXYhcDLNzRz32G0QZGStLwanUSfCc3j4oS9HeUX8rQR_h7w2j41YtqlsH4EJGivI-jxs_SY9jTPBdxYRWJJ8_cE5tlMPF26O9Q7ZVCsHdvplr7F4vuwUj2CqrQREtQ9APtvuo9HCe1BcHnWXSWwHjTB4RdDcoNmShhy-zYiil1wfd_9ga4H82TRt_-T1U4ExbhvyVUTH-V33rplQDA8IL3XcUMT9M4AzEQWf8TGt3B-1qkseU59gBxRl1wGvXL9ySid3kbdSY-NSRAIZSjo0kl2wIJ5cMuw_F_MhGtxScyRBIJTQeoFFmQ8nDjp3cmmgA2zwWdRHQAMP6XKEClydGPRCs-dzcjKCHpd3q-KhCsSmvJj_eaSGqfbI4Zg4Pb-F5F6Ro5q7IuviJoGRBXv9bqHoyQS6upP2B86qvpPmyEeEBmQelgqTF2k7HgbETHCYp7fJTG-OvnFyjsR6figouAhdRUrqndBpTvJa4pPlT8WvnEsW2PgcTSsmEdG-hW5WsMPmf2cdtkcsv9uNuRZ6ECma65d6o2jO7kSAf00ygdkKR_J08gbedIdtCqcUWYRxkvp1znsvIaArrGC3AFp8CQMPUZ5pyGcKK6s7FOaZn5XcrvbDPVRl96OTDb29W9l75D4aIu2eRbcdxqmzZtJNQuO7UjPSQZ7u9J93qxDCp72NB1jb3uluy8N3sYGEeVtz-Ryb39Yk2r9t_aBfLKIsaVTSQfrMtCvW6siRcHbpyDoQ-zqmhS-BBtMv1RkiZucx34jy-cM-tnQxHjtdt4Gk99OgPwkxOwy0Mbc3QT4Lee3818OOZgY85n926Hk3C5pJ-AqoDj4D7ICQ752YVQlX2f2GrlNDGTemd4lYqxUR7YCKM4dPFGFAl_bwoCB-XNnF6F5sonJZuYy8ed4O7I92ZmVv_2M2KQ4jkr8U5t0gRo-fIsk_zCZwwcb67HNV50-Y4MSiGOXFomBO7Phu84_cXzxVFoQn66hweHWyAn5YJI5kMqEpkRfM&sai=AMfl-YTMjzJGajxavpRoosTYpghf-_LQ7SXYXWphCbbJkvwhuex3buUHFR6aRegC4BgJVp5UJwsYCHNjGlsFKb6Qgk_NDqGd90E63vSiozMYHqL5jaLybzOFVvdDHyzp5GVH29-7l8MmVQ-hzERkOuCqaRUHC6YAoh1miGkJqao&sig=Cg0ArKJSzGtwn7TnrbEzEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=113&cbvp=1&cstd=110&cisv=r20210603.67174&adurl=

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 08 Jun 2021 07:01:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 styles.min.css
s0.2mdn.net/8364841/1622810317644/ Frame FC77 4 KB
1 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364841/1622810317644/styles.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7be3c9573f583aee91892008fc79c6e856ec49c7c1eb05291949fdfad47afb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76824
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1329
x-xss-protection: 0
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91013998c86bb1f0ec65bc0d327ccdbab823bc1c7c66633260b60bb26f222aba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:37:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 77003
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:37:46 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 3 KB
3 KB 8ms
8ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49b7c117276f79889a7df3b16c5999988bbceeb7bba6856eac04749462c56a6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2883
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 2 KB
2 KB 10ms
8ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1885ab7ea9131fa4b82723b8089f67bb29b5f8f0d81b3ca5865bd70322f96851

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1684
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt4.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 15ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2943d66a4759e9ccd28f7f4988ee6f016b2f2eb87976756bfe615d953139c49d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1036
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 prod.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 15ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/prod.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d60f45f571e0c10f22293f78453efd82473ac2b68fc7c6ac70f9515f8d3c3b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1345
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 box.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 2 KB
2 KB 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/box.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b03abc1b9b2ca1c4ef417cc53b72bf1c28a72a5ccab4b88cd9ff566b26276ee3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1633
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 pup.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 4 KB
4 KB 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/pup.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e1576b08f338663483e15dba3e04877b22827cd73e8720bdd31d2e9b8a53965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:37:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 77003
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4422
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:37:46 GMT

GET
H3-29 200 pup1.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 3 KB
3 KB 14ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/pup1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d152d10e9c3afcf73f176d35702db64cfa4968e92ac06d8aa849f9ab6a1274ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:37:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 77003
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3315
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:37:46 GMT

GET
H3-29 200 footer.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 471 B
493 B 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/footer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

affa4b4885b593b183e3e43671f4558fefae8eed10e3105d185e0e4bf1e5975e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:37:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 77003
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 471
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:37:46 GMT

GET
H3-29 200 txt3.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 870 B
892 B 13ms
11ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

856499ebcd03738f4429d484b69da18db3564a7d2ceea9bd2c6ba209d01c394b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:25:56 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 2113
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 870
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:25:56 GMT

GET
H3-29 200 arm.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 11ms
9ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/arm.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5498ff3c883da1769e46616d18e8d96321c4c65ef99625b2f74655550b2181c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:37:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 77003
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:37:46 GMT

GET
H3-29 200 arm1.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/arm1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da6c29bf4b07ffd9877c3da329888417ad3b9407e101969c131d923849bfc190

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1591
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 orange.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 335 B
357 B 15ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/orange.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5265189549cbb3210085371932ed40ac560d4308028514f4b9151ddcdfab0133

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 335
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt5.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 15ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ea452011824be7c361e1a3d5babaeece91af50f2c77199bd204c08e4dfbd956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt6.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 1 KB
1 KB 15ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91aebefc21d6ac83cc54a830c84109a4b084febececbc1f01a110831e6d94e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1444
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 promo.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 688 B
710 B 14ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/promo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

762b58706367082c8fd31f495a2d82135e6dac8b41f16ce3e30fb8983f0144bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:37 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 688
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 txt7.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 3 KB
3 KB 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/txt7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e421626de8830e99e7069da52aa8c27f46a3e12126113efebe155f38ef7857d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2654
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/8364841/1622810317644/img/ Frame FC77 6 KB
6 KB 14ms
12ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364841/1622810317644/img/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2ee065580e802dce509ca4b7351da9a0718b45846bd04c0cc284995db30ed58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
age: 76824
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6392
x-xss-protection: 0
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 scripts.min.js Show response
s0.2mdn.net/8364841/1622810317644/ Frame FC77 71 KB
26 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364841/1622810317644/scripts.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364841/1622810317644/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49731944d1ed2edb35e1fa1e4c86b085030ac853ba09b5d8acc5a4155468eae8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364841/1622810317644/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 09:40:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76824
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26763
x-xss-protection: 0
last-modified: Fri, 04 Jun 2021 12:38:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 08 Jun 2021 09:40:45 GMT

GET
H3-29 200 6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7A88 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8047292d138b4f46fbe8493b4feed7d0e7777ffb56b3cc7ca0c7131ee9fe21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 11:08:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 157975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5749
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 11:08:14 GMT

GET
DATA 200
OK truncated
/ Frame FC77 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 643ac89572093a4c907c1af802b3d354453c64d545dc3f1be1ce689046064511

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame A273 0
23 B 92ms
60ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 n.js Show response
geo.moatads.com/ Frame DDEA 124 B
300 B 76ms
27ms Script
text/html 18.168.223.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=1597158916&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-UDc31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-GQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fsci-hub.mksa.top&lp=https%3A%2F%2Fsci-hub.mksa.top&t=1623135669206&de=347340901525&m=0&ar=905afaa-clean&iw=7038f66&q=2&cb=0&ym=0&cu=1623135669206&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25986885%3A4440622%3A305210296%3A152361009&zMoatMarket=FR&zMoatADV=8364841&zMoatDBMCampID=51925245&zMoatDBMIOID=20750154&zMoatDBMCreaID=361167402&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fsci-hub.mksa.top%2F&id=0&ii=3&bo=mksa.top&bd=sci-hub.mksa.top&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A34&jk=-1&jm=-1&fs=191984&na=2024359516&cs=0&callback=DOMlessLLDcallback_53700827
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.223.48 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-223-48.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 13b221e5340cb4a82d5a650279e340c9743d34d978106324e8e678b6b45d59fa

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "5673906b3d85bffa51b7d297d0aa9185e397416c"
content-length: 124
content-type: text/html; charset=UTF-8

GET
H2 200 v2 Show response
mb.moatads.com/s/ Frame DDEA 223 B
398 B 75ms
25ms Script
text/html 18.135.182.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/s/v2?url=https%3A%2F%2Fsci-hub.mksa.top%2F&pcode=havasfrorangedcmdisplay758646212611&callback=BrandSafetyNadoscallback_53700827
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.182.208 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-182-208.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 58a0a66d6b66f797e30c54cb1d93600a7bb51247c3aa8142c4b37babf94fc218

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "6af6e4be4aef7bb601114cff0fc2f44a4510e376"
content-length: 223
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame DDEA 43 B
260 B 37ms
35ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&hp=1&pxm=4&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fsci-hub.mksa.top&lp=https%3A%2F%2Fsci-hub.mksa.top&t=1623135669206&de=347340901525&m=0&ar=905afaa-clean&iw=7038f66&q=3&cb=0&ym=0&cu=1623135669206&ll=2&lm=2&ln=1&r=0&em=0&en=0&d=25986885%3A4440622%3A305210296%3A152361009&zMoatMarket=FR&zMoatADV=8364841&zMoatDBMCampID=51925245&zMoatDBMIOID=20750154&zMoatDBMCreaID=361167402&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fsci-hub.mksa.top%2F&id=0&ii=3&bo=mksa.top&bd=sci-hub.mksa.top&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=havasfrorangedcmdisplay758646212611&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A-%3A-%3A0%3A34&jk=-1&jm=-1&fs=191984&na=119103663&cs=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 200 container.html Show response
d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C1BA 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060301.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 07:01:07 GMT
expires: Wed, 08 Jun 2022 07:01:07 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3BFC 624 B
299 B 25ms
24ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNWBw50LvFz116Sv_xMRjD6FX6jzu8CrEhcpNcRr8doqcW0S0prfrUOKS0M3ow9bFejMi4PZqivcZU_J3oaW3XP96mhVTuIOce3d4GH71nm0dgJndpB712VF22GXC3c4fZvge-Qp6q5tQUBIgkqSc0Kblea4AuQz9pxonFWxJkQAbB4pvZI

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNWBw50LvFz116Sv_xMRjD6FX6jzu8CrEhcpNcRr8doqcW0S0prfrUOKS0M3ow9bFejMi4PZqivcZU_J3oaW3XP96mhVTuIOce3d4GH71nm0dgJndpB712VF22GXC3c4fZvge-Qp6q5tQUBIgkqSc0Kblea4AuQz9pxonFWxJkQAbB4pvZI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUln-Eu74OFHMh3irpcswOdwL3WQ8c6wEYOvPYpFVoxyZi1SW0CDX3Mh_enwwj4; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 07:01:09 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3CE7 11 KB
9 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoKgGsi_CU10tf-asXOm8XYoUjqWMkx-wV2qqdEEduxflkBZseSNCKmnFLtKAXcHEGtOr8aX_VbLbWO7IY2GpcBtorJvypItYIiJSfRRxRxoaiTur1hpDSpIhexlgwz6MO7ITmJJGTxULQmY5cO9do-4lsSQ&dbm_d=AKAmf-AtyhTNo-dySH3Bo7giwKcb7DnApzpji8YTX3Mr6pmKomaXhv1ERYpI57Cpa9Cx7EcRm-QWvoH_Bp8Gr4vJA5LnSnBkVuyO8VfnP_jq5s0BCq3TNJQxHjfubcdD-iKz9gUE5o2VI0jMUBaTjXLoyGpiOASxWCA1-vohbMdwAme5DWt9DK9Yv_a3IV7TkUhpUCPdUvKYjdxF-z7Hg19wjkp3RWKUZBScNXzTwOOtrOsMBLeYC1_sTKkzMtnsmYe51YzpZ1FI8Hw1P0EpoIIkhryjCHY4Bs15dkVddMJKNTWqlltEASgKm-R-EQRJeK3mm7kO5CMSjYyAg6xnezU1_pN6NmwtzceTUMAMrkm0Z8ewBy3HrVAJUm3ITGe-gPz2M7ogNbA5vYnD38N-7a08WW_plLygm7Cpo4eSkzuQ4Ulq-OTBhKYF7JDsJqFlVgzGJXgvLK0xKA8ztZ1MuRbKxN6alULilLK5x1pzzy8uvVQjGGx1_3hu4jSojOij0AXosQNMgrJXqKfw_Too3lq5Df5LE_87O0-X4xIBHHkbPFgP_vxY14ZZctVnGaAMQEV5gP7j-ASF4Dt1JheGhorPIYGY22eOkTrfJBKuLHLlKEDfwQy3B80i52bDCEjEr0YdOIw9nfYyEW-OkU8x9bgOZ4z7x-zLMZkgfnTIdE4mNgyR3pjOx-hZA09rPDgJwNl8JoASYCquOk8MRxMCfj1sZUPXpF1W8RfTg-wCj5mhpsarNOQVEuey1a-LGkKGzMnyyOJFYN-bgZRsmo4rmVNqCdBfKTOgse_BasBa5GS5WiTA2D8eSFVyg3ZrZz44nroMSXBvekV9F_J5RtUvq0J8eZPO3ZtDAHR6UW54GH_h12UgFqTb2tIfeZzgL69nINR5ioCHf2JIXtPqLU2AzUlqN41XY0jfKTJZt5zPjEnlGCrahFTMbbFrLVaWDBblel6-cxbc4ytspEo2B2c2eLVdD60fXBuS4j3pqy_b9ty43duH3rHuWJLqKPLKJVlQJFd6so4I59lGjXVtb5eEm4l-ZooqL0_ZDqYA8Z28CbHKzzYh6b2UPH6KVpVH72OSIgBavyvKkcW2SlIc46QlkjY_78LP191mtS0sG3HRxQ-sr39ve7YB3X6DPgRaG1rLCuiW9QMN5o9k-55CA0bFgBFjSfzuRxuv2DXyliiSUtDgkzaW_M0xOfwzt8Ai9UO8xTmKP_qqt3WNdQCY7CJh3dBRb3ukx1GNofHFkJ29vjtI2MxZxLx5yX-wvvtKCFNS1sFJbmxtmpnOHYElx6YcPOglOrjS3DvmfNJwi3UXtnd38Jh3Y2VpdixqExB6a8bcjDFNEInTzH2iFlSS0IAnwI2W36tkL3l03S7hRhLHuF4fYT5l3INwx384AW22R54c8dlfL0RiCqvNrZauGEWq2V1resewSRxS6KOgkI3D1-ycr3byImgVpjRD9cG8-Clcdj2uW5Ru41RxozQ80lc9WYMChdYNx2ou74Q5WENSdP31pEmWIJAqjtdibWEk0uHzYG0yTx3pR_DPcFnk7tTEg3CyjHXzzaZvR3nkT2ZORAIUoKgDWlvo1Y_YUma4Ie5c9zhPb6y_SEirIK66b2-GbrXZS1YkysKjEBwj-dsfHHBk5HPNuQeQlvvd5ibrQWZq_FjipFTWl0Uqwr46SyOY3MrZhQBPDhrgi8y7tidhIDmh9MmUXqQIPfLqEfXsyfsFWxSXH15sfQ4WmcKcpITSsQgGDs2p_agcE8eyKhGhRj2GP6nEkoB8dW_vM9GHVjNsBvWB6e7finbifQ00PSlvYqbSJasz7mKQjB_op5pZpMmc211-iHOTiVYSjnM-NuZnzSyTurPCFGs1G5JtSamycGvA3Zjzus3qcPrJ3a_m8aeQei7XEVXoXH3jwQt0zkhdDjEbl-kTpzrpgQalUbDwQTxunLLlUb0Sde8abuUugQpJIEflHVxA9WRFN8fe1qACv5HG5LJ8Cx9Q3_t-OO2oiiQH-sG9tnAXOxhGAkJy6xK00kb_h_Ybd1I2k04e3FT6I0eEthVqLaM3BFvPfSOLzVsrMw3n8pO8cUjjlST5D3sZkaxVHCoyT6kKOQV6bLLlsZzz5lsaUtlFt99mELCissDRIAN-dS1IOqdRnRYfeCnbyiXhK-OANfByQ5y0KaEzTM_5A-vJPWMGLfto9g4Yz_Y4AvcJv9607Ct620uaYS6Q0tEHVjAVNE-j_MxdR50Z_94ETmg14A2lAtIMAZK8k92hNhLii2idJcl8BYWPig35gCq9eoVaxV8Y97kzP0X8WBwz68Jv9WmXq-wZ2RRaBC_sqKK-hXYA2frdU-Pw8Jakk4tXnAehd9GIeBnPKIF9AmloHgLsYc_CNnT_Tdjg6gGhOYpkiSBjGU6sECyNTCdGBCUiYWDjsnBsxB9hh1QV4SFEFT4QQ3ARNOhbzNptL2Bwaa9gtd1GOsQCIJjrm0-sEaTdBWyFibSw7yeGP9MM2ZxXWzF9PbSiPvWeVFKgUr8dikU7Mx3yu6jXAxIYDTBwqMOM48uQ6L84s-P-Rvj_oPYFTo64PpeKYTsfjjEpvz4dlKwAF5A9eDR_z3VPLNy9ISGMx2xjvP8qs6nlNeE7b6jIhiuN5sndlOxEnp_zxaL6s9xsRG6E5DSya4MfvPDWIvA0Ykyr8jt6U217BdaCCbv7F_QdpaKLQTzdlokPLwvvEnA6nxcGSXUuwdaJyWX02uvugAPObNgPfpRY_SXceAtlU9duKNA4Qq9gITjMxs8EZQK4SxvDTa0VLCcNl5BTCCxfNiHdTS5aLZaN6qzMFHlkmoB2b_n9xbit_kRCFcO4NVJ8hrlTHcATs1znfYD24VE6gZHNfFLxp2lK76TnioT36FtcRp8ZmEUHd-gV7SIlbvAzTiA9JV8P91qFC2goNI7zz4236jNHf7u5qBtSRRJJxoJUvohgUFuZ4L32VxZDlTN5-oZce_RRrn-n2nh-KWB5Pg_ZXgmWYmiOLfFgJ7v88STUrdmVxwjiUePzuNN8jfmhX_sBMFONhBkuNWMcV2VKM8cQs2GyDI8iDhtUZTC953VOVPVALOtclxcCPZxBsPmufI9vZZ-4gn42rs1HLPvRk9UubuB4ywC5gbIqB4bmY_q8IjUMhXCQvz7CbBt9toNvnhHgoMDJOKX6BsHcLJ3w1X1MIp4cLZDKUXpNgJZM_1kzrf27jBfFUmysIYSMS0bPFMxgfg&cid=CAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a1849d66c98c04a99c563e0925b60497ec63711d091c30b733ea4b62ea06395

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8703
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 3CE7 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 95
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:59:34 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3CE7 122 KB
37 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 3CE7 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:57:43 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 3CE7 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRyLSc1anymRbA9nJVM7_L53fYDWO-uew_t3MbqPoMei6MwrShxHjUY1f3Nh1QZpM5wOGQ-UxwhTO9SNSX3hyKgkAUhvQ
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3CE7 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DUHlBI5BXUT7RDOTClbpsN1fliMxIOCYXO8yt1LUKUACf5WL5PhDgyHmWq81bubtvBRV7nD2VRXPwIOES6PGkr3JaYMPvvKstVZi0W6WcEjBkQ5oY

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame DDEA 43 B
260 B 38ms
37ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8364841%2F1622810317644%2Findex.html&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=1597158916&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-UDc31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-GQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fsci-hub.mksa.top%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fsci-hub.mksa.top&lp=https%3A%2F%2Fsci-hub.mksa.top&t=1623135669206&de=347340901525&cu=1623135669206&m=67&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A-%3A-%3A0%3A34&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=48&cd=0&ah=48&am=0&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25986885%3A4440622%3A305210296%3A152361009&bo=mksa.top&bd=sci-hub.mksa.top&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364841&zMoatDBMCampID=51925245&zMoatDBMIOID=20750154&zMoatDBMCreaID=361167402&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&tc=0&fs=191984&na=520610731&cs=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021060301&jk=4260403759491277&bg=!oaKloubNAAY6sG-_OrA7ACkAdvg8Wgaz1zlG94wd7Cm2yf7YG54u-WOXeV0LxVBR6XpDA9j1g4pAawIAAAC7UgAAAB5oAQeZAmW87BG1cTFntSRlQFqL_p3CofCkaiwWnsG8OQoNZymn0ZF4csz1y4qnt_E-2tm33ynyCQOitVozRtjHZBatyn2XfF_enimK8cSQ7PeiMRPj_zPgMgiATSS8MW-IxEaAOnGJxjOLDqNWyXTJ8FKnS7zlJo0M9ACUTQVfkjsLZ_ytItp7zFkXspDQM_0mz6lDxv4eTRowT7wLZXZ6JMRriUWDxAK7jhDLkkT0GAAvFgKSXScoSDB5fp_5WtxXNwFlCsK-GD-p2A8lAD7dLX7T5Dj6nIg-EgJzfidk06RYctm7dO_YT5AX9-w08W5lZwS0YItP6WdwdTZAC4LUrPv3xxpCCKWTP0gFHWSPrMz22AJFwETANpCXODCRs5gvvluVPcYSKO7S1exkjeGTrHcgPIMoYbjKdEyQFv5GLECBIQt2Rte2BifoaWrHwhiDifdBIcCO5lqqg6Pp1sAMDCgRZ_OsCfR8RdWWE69PTyw5-VA7iL2TkTJ4YBfaD66D61H9mOwHRM7Nue8LNbv7oF0hnlYYU0KMMcFYm-ZD7j65mxhjcGVgRkXBZW_BCZqPuHOW23xsI6BWN6fCvULZfXjBbSF3Tzz_v1N53uKVcrDWexAUezs-3VHh8BOaF9wJvkSDyPqfdNowzuj9FNicIxUZU0He2sDFLWN0c-MzUG-RZj5Vj_q5-5UJ1Q4XzMn4Mgp5roO-FAVr3UxbzM5bGClC9S6v-oAmrQEvoNiLYLLcxFxFzmbSsQv7cANMVXeeASa37qIrKQVUtiRE47hLNCna78xQfAvkFnVKsI0eoVNevNht2LXgVoaF

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame DDEA 43 B
260 B 47ms
45ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=48&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=sci-hub.mksa.top&L1id=25986885&L2id=4440622&L3id=305210296&L4id=152361009&S1id=mksa.top&S2id=sci-hub.mksa.top&ord=1623135669206&r=347340901525&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364841&url=https%253A%252F%252Fsci-hub.mksa.top%252F&bedc=1&q=1&BSD=safe&BSC=gs_society_misc,gs_science,gs_science_misc,gs_tech,gs_law_misc,moat_safe,gs_society&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame DDEA 43 B
260 B 38ms
37ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=48&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=sci-hub.mksa.top&L1id=25986885&L2id=4440622&L3id=305210296&L4id=152361009&S1id=mksa.top&S2id=sci-hub.mksa.top&ord=1623135669206&r=347340901525&t=bs&os=0&fi2=0&div1=0&ait=0&zMoatADV=8364841&url=https%253A%252F%252Fsci-hub.mksa.top%252F&bedc=1&q=2&BSD=safe&BSC=gs_society_misc,gs_science,gs_science_misc,gs_tech,gs_law_misc,moat_safe,gs_society&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3BFC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

43 B
894 B

43ms
43ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNWBw50LvFz116Sv_xMRjD6FX6jzu8CrEhcpNcRr8doqcW0S0prfrUOKS0M3ow9bFejMi4PZqivcZU_J3oaW3XP96mhVTuIOce3d4GH71nm0dgJndpB712VF22GXC3c4fZvge-Qp6q5tQUBIgkqSc0Kblea4AuQz9pxonFWxJkQAbB4pvZI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 07:01:09 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3BFC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8VtQ9PoeKd6iuvFtuw7gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1

43 B
894 B

37ms
37ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNWBw50LvFz116Sv_xMRjD6FX6jzu8CrEhcpNcRr8doqcW0S0prfrUOKS0M3ow9bFejMi4PZqivcZU_J3oaW3XP96mhVTuIOce3d4GH71nm0dgJndpB712VF22GXC3c4fZvge-Qp6q5tQUBIgkqSc0Kblea4AuQz9pxonFWxJkQAbB4pvZI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 07:01:09 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEg6zy8ML3Ca0Q1T6mKxOGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3BFC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDUmSckYYFtFku2H-QbHsKk&google_cver=1

43 B
1021 B

25ms
25ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDUmSckYYFtFku2H-QbHsKk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNWBw50LvFz116Sv_xMRjD6FX6jzu8CrEhcpNcRr8doqcW0S0prfrUOKS0M3ow9bFejMi4PZqivcZU_J3oaW3XP96mhVTuIOce3d4GH71nm0dgJndpB712VF22GXC3c4fZvge-Qp6q5tQUBIgkqSc0Kblea4AuQz9pxonFWxJkQAbB4pvZI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.154:80
AN-X-Request-Uuid: ccde2b6b-2dfb-460a-9252-e03c5776a913
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDUmSckYYFtFku2H-QbHsKk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3BFC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

170 B
188 B

33ms
32ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 07:01:09 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.42:80
AN-X-Request-Uuid: d0ba0653-c228-4e19-920e-8193088fa306
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3ODkxNjQ5MTgwODA1NTkzMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3CE7 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DoKgGsi_CU10tf-asXOm8XYoUjqWMkx-wV2qqdEEduxflkBZseSNCKmnFLtKAXcHEGtOr8aX_VbLbWO7IY2GpcBtorJvypItYIiJSfRRxRxoaiTur1hpDSpIhexlgwz6MO7ITmJJGTxULQmY5cO9do-4lsSQ&dbm_d=AKAmf-AtyhTNo-dySH3Bo7giwKcb7DnApzpji8YTX3Mr6pmKomaXhv1ERYpI57Cpa9Cx7EcRm-QWvoH_Bp8Gr4vJA5LnSnBkVuyO8VfnP_jq5s0BCq3TNJQxHjfubcdD-iKz9gUE5o2VI0jMUBaTjXLoyGpiOASxWCA1-vohbMdwAme5DWt9DK9Yv_a3IV7TkUhpUCPdUvKYjdxF-z7Hg19wjkp3RWKUZBScNXzTwOOtrOsMBLeYC1_sTKkzMtnsmYe51YzpZ1FI8Hw1P0EpoIIkhryjCHY4Bs15dkVddMJKNTWqlltEASgKm-R-EQRJeK3mm7kO5CMSjYyAg6xnezU1_pN6NmwtzceTUMAMrkm0Z8ewBy3HrVAJUm3ITGe-gPz2M7ogNbA5vYnD38N-7a08WW_plLygm7Cpo4eSkzuQ4Ulq-OTBhKYF7JDsJqFlVgzGJXgvLK0xKA8ztZ1MuRbKxN6alULilLK5x1pzzy8uvVQjGGx1_3hu4jSojOij0AXosQNMgrJXqKfw_Too3lq5Df5LE_87O0-X4xIBHHkbPFgP_vxY14ZZctVnGaAMQEV5gP7j-ASF4Dt1JheGhorPIYGY22eOkTrfJBKuLHLlKEDfwQy3B80i52bDCEjEr0YdOIw9nfYyEW-OkU8x9bgOZ4z7x-zLMZkgfnTIdE4mNgyR3pjOx-hZA09rPDgJwNl8JoASYCquOk8MRxMCfj1sZUPXpF1W8RfTg-wCj5mhpsarNOQVEuey1a-LGkKGzMnyyOJFYN-bgZRsmo4rmVNqCdBfKTOgse_BasBa5GS5WiTA2D8eSFVyg3ZrZz44nroMSXBvekV9F_J5RtUvq0J8eZPO3ZtDAHR6UW54GH_h12UgFqTb2tIfeZzgL69nINR5ioCHf2JIXtPqLU2AzUlqN41XY0jfKTJZt5zPjEnlGCrahFTMbbFrLVaWDBblel6-cxbc4ytspEo2B2c2eLVdD60fXBuS4j3pqy_b9ty43duH3rHuWJLqKPLKJVlQJFd6so4I59lGjXVtb5eEm4l-ZooqL0_ZDqYA8Z28CbHKzzYh6b2UPH6KVpVH72OSIgBavyvKkcW2SlIc46QlkjY_78LP191mtS0sG3HRxQ-sr39ve7YB3X6DPgRaG1rLCuiW9QMN5o9k-55CA0bFgBFjSfzuRxuv2DXyliiSUtDgkzaW_M0xOfwzt8Ai9UO8xTmKP_qqt3WNdQCY7CJh3dBRb3ukx1GNofHFkJ29vjtI2MxZxLx5yX-wvvtKCFNS1sFJbmxtmpnOHYElx6YcPOglOrjS3DvmfNJwi3UXtnd38Jh3Y2VpdixqExB6a8bcjDFNEInTzH2iFlSS0IAnwI2W36tkL3l03S7hRhLHuF4fYT5l3INwx384AW22R54c8dlfL0RiCqvNrZauGEWq2V1resewSRxS6KOgkI3D1-ycr3byImgVpjRD9cG8-Clcdj2uW5Ru41RxozQ80lc9WYMChdYNx2ou74Q5WENSdP31pEmWIJAqjtdibWEk0uHzYG0yTx3pR_DPcFnk7tTEg3CyjHXzzaZvR3nkT2ZORAIUoKgDWlvo1Y_YUma4Ie5c9zhPb6y_SEirIK66b2-GbrXZS1YkysKjEBwj-dsfHHBk5HPNuQeQlvvd5ibrQWZq_FjipFTWl0Uqwr46SyOY3MrZhQBPDhrgi8y7tidhIDmh9MmUXqQIPfLqEfXsyfsFWxSXH15sfQ4WmcKcpITSsQgGDs2p_agcE8eyKhGhRj2GP6nEkoB8dW_vM9GHVjNsBvWB6e7finbifQ00PSlvYqbSJasz7mKQjB_op5pZpMmc211-iHOTiVYSjnM-NuZnzSyTurPCFGs1G5JtSamycGvA3Zjzus3qcPrJ3a_m8aeQei7XEVXoXH3jwQt0zkhdDjEbl-kTpzrpgQalUbDwQTxunLLlUb0Sde8abuUugQpJIEflHVxA9WRFN8fe1qACv5HG5LJ8Cx9Q3_t-OO2oiiQH-sG9tnAXOxhGAkJy6xK00kb_h_Ybd1I2k04e3FT6I0eEthVqLaM3BFvPfSOLzVsrMw3n8pO8cUjjlST5D3sZkaxVHCoyT6kKOQV6bLLlsZzz5lsaUtlFt99mELCissDRIAN-dS1IOqdRnRYfeCnbyiXhK-OANfByQ5y0KaEzTM_5A-vJPWMGLfto9g4Yz_Y4AvcJv9607Ct620uaYS6Q0tEHVjAVNE-j_MxdR50Z_94ETmg14A2lAtIMAZK8k92hNhLii2idJcl8BYWPig35gCq9eoVaxV8Y97kzP0X8WBwz68Jv9WmXq-wZ2RRaBC_sqKK-hXYA2frdU-Pw8Jakk4tXnAehd9GIeBnPKIF9AmloHgLsYc_CNnT_Tdjg6gGhOYpkiSBjGU6sECyNTCdGBCUiYWDjsnBsxB9hh1QV4SFEFT4QQ3ARNOhbzNptL2Bwaa9gtd1GOsQCIJjrm0-sEaTdBWyFibSw7yeGP9MM2ZxXWzF9PbSiPvWeVFKgUr8dikU7Mx3yu6jXAxIYDTBwqMOM48uQ6L84s-P-Rvj_oPYFTo64PpeKYTsfjjEpvz4dlKwAF5A9eDR_z3VPLNy9ISGMx2xjvP8qs6nlNeE7b6jIhiuN5sndlOxEnp_zxaL6s9xsRG6E5DSya4MfvPDWIvA0Ykyr8jt6U217BdaCCbv7F_QdpaKLQTzdlokPLwvvEnA6nxcGSXUuwdaJyWX02uvugAPObNgPfpRY_SXceAtlU9duKNA4Qq9gITjMxs8EZQK4SxvDTa0VLCcNl5BTCCxfNiHdTS5aLZaN6qzMFHlkmoB2b_n9xbit_kRCFcO4NVJ8hrlTHcATs1znfYD24VE6gZHNfFLxp2lK76TnioT36FtcRp8ZmEUHd-gV7SIlbvAzTiA9JV8P91qFC2goNI7zz4236jNHf7u5qBtSRRJJxoJUvohgUFuZ4L32VxZDlTN5-oZce_RRrn-n2nh-KWB5Pg_ZXgmWYmiOLfFgJ7v88STUrdmVxwjiUePzuNN8jfmhX_sBMFONhBkuNWMcV2VKM8cQs2GyDI8iDhtUZTC953VOVPVALOtclxcCPZxBsPmufI9vZZ-4gn42rs1HLPvRk9UubuB4ywC5gbIqB4bmY_q8IjUMhXCQvz7CbBt9toNvnhHgoMDJOKX6BsHcLJ3w1X1MIp4cLZDKUXpNgJZM_1kzrf27jBfFUmysIYSMS0bPFMxgfg&cid=CAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:20:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2456
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:20:13 GMT

GET
H2

200

as.php Show response
nxtck.com/ Frame 3E52
Redirect Chain

https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgt...
https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgt...

3 KB
2 KB

35ms
34ms

Document
text/html

130.211.47.109
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.47.109 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 109.47.211.130.bc.googleusercontent.com
Software: adserver-canary-57cdc5f69f-8m7cx /
Resource Hash: 78cd13811c49b29160569d58ec4f16f9b57f771865cb4ca0b2d707d2bb8a361d

Request headers

:method: GET
:authority: nxtck.com
:scheme: https
:path: /as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tc=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

p3p: CP='ALL DSP LAW CUR DEV PSAo PSDo IVAo IVDo CONo HISo OUR STP UNI NAV'
server: adserver-canary-57cdc5f69f-8m7cx
x-robots-tag: noindex, nofollow
expires: Tue, 01 Jan 2001 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
set-cookie: uuid=fe029afe-3909-463c-bbb0-64f58faf66e2; Path=/; Max-Age=31536000; Expires=Wed, 8 Jun 2022 07:01:09 GMT; Secure; SameSite=None
vary: accept-encoding
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 08 Jun 2021 07:01:08 GMT
via: 1.1 google
alt-svc: clear

Redirect headers

p3p: CP='ALL DSP LAW CUR DEV PSAo PSDo IVAo IVDo CONo HISo OUR STP UNI NAV'
server: adserver-ga-6966f9dbd7-8nmn9
x-robots-tag: noindex, nofollow
expires: Tue, 01 Jan 2001 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
set-cookie: tc=1; Path=/; Max-Age=31536000; Expires=Wed, 8 Jun 2022 07:01:09 GMT; Secure; SameSite=None
location: /as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
content-length: 0
date: Tue, 08 Jun 2021 07:01:09 GMT
via: 1.1 google
alt-svc: clear

GET
DATA 200
OK truncated
/ Frame 3CE7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 692ba2c7fd7f1050fc711d4414e8989327222bb792d64093289de9a7227e54ca

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A88 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQaVltBW_YPDvNYHz3wPHiaqIAgAAAAA4AeAEAg&bg=!pqWlpeHNAAY6sG-_OrA7ACkAdvg8WoVkF5bF7dLJ6XXbUOhsaIiT-G8TQ13pjW-c4dBK-3s1ROB4lAIAAAD5UgAAAAloAQcKACwhj6jaNvWZHR8anZdxPUKIErBcgS02sXEqV7QeBh0fBZOD1mX-b86xjgn3IJkDGBglD66xGDy_dNW4DNHW8SrY1p4i7ctA-a000EbAdPqBcgXeS-AlOYPFVkF3JRyZRTHPJKr4woHARAuDce_pELmDe2tIS7bS07uILTdzztZ_AHSKsKF2i3bAVf8J1x1zYgAMzfmg-P7k4HUr7sj57oYyez9MKBUCg7p3VlzIiE_U9sc7Ao4WdSnSIQScnAuJuP6D8piNN3rdKn92Kt7oq-WtHuaR6Wl8Tjov7Ixm80qR14v-BxbHH-_onQxbEUZUAYrEQWfmoyq2DJzakUdMw7zCvI90M6CRhA_cX9iVB2U1_cYAxzsvsJUQv7kUgEPMxHuGByGk-9ubRjcwHlYeHgU85dO8_1-JwIWSzAjjXiCmkwZSVBJdhoQZQ6kBhT9b2GNhYndMRKUIP8RXys3g8A8WY8LnNSP21qWE5Z9A1DHjJJsDZPWCboRjEQXnSUpEEjieRQpKPYWM0jJjOya3QfQX3QoCq5HU4DRKYoWvUEczl9VdZc2sjIPN5iyw1LXs2Me90RdZqPq1CcWYOHzjSBGkdia0xb_ah3Qu_5AUm9BfLm4m7AmBlKmZYuF6zMa5aTblL-6MqriAngaRS4_G_-odnhv0zIHWkaQisWQ3GPQq0sp95K0F-voeVUN06LGH0Kiq02dgqsJ79hT8CSGrhS2J6K6uujpTeNqRJ0YjtVot8C6HU0lxgivzR0afKLwezjfRm555kfNoSEsHtxWT-t-MW4SQezrINVvc3PDM8bXay0d-4o7-UOw75hsdwmFqe2_BjKrju9ItzRY69rbfegSfzhjd0FPy248PmaT-ixIRpTlirlbq6LM8ozHzhTUMVdh2LCOeYMYiC7WiDvZKKQvmYIrGM5c1fbeGGvSIPQQstBodpQFSYXgvXQjLJBmpuLgcpQEAy9DBHU7X9syST-gtCtOTdoKDFR9x9XpMhLz9CayeuR9pEB1t6P3s31dHPyUUrU8Y_TL9XsX_5Wp6oSPt0hlJ3i3KyRwJE7Wh-Nlb_ifyhsVamCgcWw4yDM6g629ahSn5e73uQmrRqBG_2vBKAZZGgeWdWg

Requested by

Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A16E 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 07 Jun 2021 21:53:56 GMT
expires: Tue, 07 Jun 2022 21:53:56 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 32833
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel.gif
px.moatads.com/ Frame DDEA 43 B
260 B 38ms
37ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&pxm=4&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=HAVAS_FR_ORANGE_DCM_DISPLAY1&ol=1597158916&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-UDc31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-GQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=970&qe=90&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fsci-hub.mksa.top%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fsci-hub.mksa.top&lp=https%3A%2F%2Fsci-hub.mksa.top&t=1623135669206&de=347340901525&cu=1623135669206&m=206&ar=905afaa-clean&iw=7038f66&cb=0&ym=0&ll=2&lm=2&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=90&le=1&lf=92&lg=1&lh=30&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A-%3A-%3A0%3A34&aa=0&ad=74&cn=0&gk=74&gl=0&ik=74&ic=74&ez=1&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=48&cd=48&ah=48&am=48&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A2000sec%3Acontinuous&cl=0&at=0&d=25986885%3A4440622%3A305210296%3A152361009&bo=mksa.top&bd=sci-hub.mksa.top&gw=havasfrorangedcmdisplay758646212611&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatMarket=FR&zMoatADV=8364841&zMoatDBMCampID=51925245&zMoatDBMIOID=20750154&zMoatDBMCreaID=361167402&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&tc=0&fs=191984&na=1679268792&cs=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame DDEA 43 B
260 B 46ms
45ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=74&fi=1&apd=195&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=sci-hub.mksa.top&L1id=25986885&L2id=4440622&L3id=305210296&L4id=152361009&S1id=mksa.top&S2id=sci-hub.mksa.top&ord=1623135669206&r=347340901525&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364841&url=https%253A%252F%252Fsci-hub.mksa.top%252F&bedc=1&q=3&BSD=safe&BSC=gs_society_misc,gs_science,gs_science_misc,gs_tech,gs_law_misc,moat_safe,gs_society&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame DDEA 43 B
260 B 79ms
79ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=74&fi=1&apd=195&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=sci-hub.mksa.top&L1id=25986885&L2id=4440622&L3id=305210296&L4id=152361009&S1id=mksa.top&S2id=sci-hub.mksa.top&ord=1623135669206&r=347340901525&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364841&url=https%253A%252F%252Fsci-hub.mksa.top%252F&bedc=1&q=4&BSD=safe&BSC=gs_society_misc,gs_science,gs_science_misc,gs_tech,gs_law_misc,moat_safe,gs_society&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H2 200 pixel.gif
havasfrorangedcmdisplay758646212611.s.moatpixel.com/ Frame DDEA 43 B
260 B 79ms
79ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://havasfrorangedcmdisplay758646212611.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=74&fi=1&apd=195&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=sci-hub.mksa.top&L1id=25986885&L2id=4440622&L3id=305210296&L4id=152361009&S1id=mksa.top&S2id=sci-hub.mksa.top&ord=1623135669206&r=347340901525&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatADV=8364841&url=https%253A%252F%252Fsci-hub.mksa.top%252F&bedc=1&q=5&BSD=safe&BSC=gs_society_misc,gs_science,gs_science_misc,gs_tech,gs_law_misc,moat_safe,gs_society&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 200 6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js Show response
pagead2.googlesyndication.com/bg/ Frame A16E 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6ARyktE4tPRvvoSTtP7tfQ53d_-1azzHygxxMe6f4h8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8047292d138b4f46fbe8493b4feed7d0e7777ffb56b3cc7ca0c7131ee9fe21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 11:08:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 157975
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5749
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 11:08:14 GMT

GET
H3-29 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 3E52 8 KB
4 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7c1022dbae2ac5b2997f6e92f1f25907b053736a52aa40753fb44fcf4760370

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:03:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3796
x-xss-protection: 0
last-modified: Mon, 07 Jun 2021 18:22:56 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 08 Jun 2021 07:03:53 GMT

GET
H2 200 rm_iab.js Show response
cdn-ssl-as.nxtck.com/iab/js/ Frame 3E52 3 KB
3 KB 97ms
31ms Script
application/x-javascript 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ssl-as.nxtck.com/iab/js/rm_iab.js
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 77dd7a6ab6c5b70535f944b314aefb2139419836cfcac9d57f765fc7c123b82c

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
via: 1.1 google
last-modified: Wed, 14 Nov 2018 22:57:04 GMT
server: nginx
etag: "5beca840-a1b"
content-type: application/x-javascript
accept-ranges: bytes
alt-svc: clear
content-length: 2587

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A16E 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-zNhtRW_YJKrFYLT3gPLqYiwDwAAAAA4AeAEAg&bg=!tLelt_PNAAY6sG-_OrA7ACkAdvg8Wkv8_CfHojEsVgFELFEA9AKwykuVY60zw28rBqDHqJOOB1HVwAIAAABXUgAAAAloAQcKAEpN6EUNwZSqHxIjc6PEqyqDg5DChFEp-EDUQVKWcQRmqA1f6wSEDaXYMef8m8YoPXlkaALkIOG2MQAFhF6ZuM_xJsJuOVxmHGmamJkDFKvPcTGJNwrzA2OkpLXoBd6nIdSdFMHHXj5rzpwY1423btGrHjkWCdluq_uHXUa_hh86tpL7C4xzVosPa9ERPeewTv57qndPbSxX1pMbEunZBhlyMKNAqB_IHAxWu1rl-fjEy6_DjL0NNleQzqIHad_tHxsjrloU6xVoO-MEspzoYNLiDzPJllEcPkzeczDH32IdeKTuDK9M8kHJFl7hHAjUSEcOyy2vmblMLs6odPejbMlL9K0r0DYu1khcnTSRzO8D_CNiaLr_Dw7SvXmWp3kZn_wpVTxQhT9qSssFHuJH7_6SMPlqJFXs-Ljtc9sRU7NKEubgMhm_3eOkgmLVrK5ckg5Q1Kb8A2zD6vgJFFowsYdFk6JiQR4TYe4x1Ret-iOs6PPTftkuFY6jbgpkSuRSwztd2NxHowgSP9UhhUI5aSPcwmxe74s5bzPc2HeZX66B8L46nuHSUSrQ9VMpXKRmMneXKxt-HxXpnrStQ8BcFXnkP_gjbPT_WNJjoEkBvcQ_qhHIm_hT8XhEMh_NoKIQZ_Zs1_1bZ9fhpB8twPPJ7qPfkJwx3to5NNq67QMAPoxNbubWwVvVzGV9_5nNG_FRNKHW4umD7lUb401aX9t1uZZeV842IZelEe6Uq8bOreVJ2NdKhFknnzDQXaNrZXTPzH0v7tnzH57eqbNCI8oMM_yQOBfFsVUIYtMzFTOYpRHXRPsXp2zdx-kpsrAUIdy2n9OGH4gIIa8nLSXP_52RrVhvlrwJVKBqpOBewca13qUtK1oQQTB21K8xDPf6jnyOi3ASpRrUZwbJ88TwjiPLfICeWXb-eWi-KAiea5OxKu1vyzz65eLJpc6ZAsHglSZWoiIAPQSyvPlWhTkOSQQhr8bnFWUDi8vjsTLB3T6K1c3t8lgctA8Qf3n6ZVB9NEtmJdKGQh8w3j81uz-Cg9-AQplf_HupjmA4tb23zafHS0v3nigqml-ehPURm9QxBZTvxl2a6Gm0s1okoiWA_0MbxvkV5UlDj2CSYsyVCOoe22EG-_6u6Y0F7MmyGYk1VjVjz52v

Requested by

Host: d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com
URL: https://d4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 impl_v75.js Show response
www.googletagservices.com/dcm/ Frame 3E52 37 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v75.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7529b11940f8a77767d97b70e5392487b7fffeb7bcd408da18bdc71665a81d41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 20:03:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 298636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15538
x-xss-protection: 0
last-modified: Fri, 04 Jun 2021 19:52:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 20:03:53 GMT

GET
H2 200 B25214695.294017284;dc_ver=75.217;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=437876951;ord=oubwzd;click=http%3A%2F%2Fredirect.nxtck.com%2Fww-redirect%2FWwRedirectServlet%3Fp%3D1%26clicurl%3Dhttps%3A%... Show response
ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/ Frame FCB9 39 KB
20 KB 109ms
54ms Document
text/html 142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.294017284;dc_ver=75.217;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=437876951;ord=oubwzd;click=http%3A%2F%2Fredirect.nxtck.com%2Fww-redirect%2FWwRedirectServlet%3Fp%3D1%26clicurl%3Dhttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D581962%26ev%3D75873%26rid%3DP1_SupEJB2WWYNZ6%26sid%3D567755672%26uuid%3Df03f711d-a376-45f6-8776-22bd25cb5059%26ecr%3D%26referer%3Dhttps%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=u'PXncxf90;osda=2;sttr=16;prcl=n

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v75.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

752872d2de49855a74f68a13e4f25e6907eb11e10b31dac1d79e4ca12114fb12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ad.doubleclick.net
:scheme: https
:path: /ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.294017284;dc_ver=75.217;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=437876951;ord=oubwzd;click=http%3A%2F%2Fredirect.nxtck.com%2Fww-redirect%2FWwRedirectServlet%3Fp%3D1%26clicurl%3Dhttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D581962%26ev%3D75873%26rid%3DP1_SupEJB2WWYNZ6%26sid%3D567755672%26uuid%3Df03f711d-a376-45f6-8776-22bd25cb5059%26ecr%3D%26referer%3Dhttps%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=u'PXncxf90;osda=2;sttr=16;prcl=n
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nxtck.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUln-Eu74OFHMh3irpcswOdwL3WQ8c6wEYOvPYpFVoxyZi1SW0CDX3Mh_enwwj4; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nxtck.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 08 Jun 2021 07:01:09 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 19743
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 OBA_marker.png
cdn-ssl-as.nxtck.com/iab/img/ Frame 3E52 3 KB
3 KB 33ms
32ms Image
image/png 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-ssl-as.nxtck.com/iab/img/OBA_marker.png
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
via: 1.1 google
last-modified: Tue, 02 Oct 2012 09:47:13 GMT
server: nginx
etag: "506ab821-cbe"
content-type: image/png
accept-ranges: bytes
alt-svc: clear
content-length: 3262

GET
H2 200 OBA_en.png
cdn-ssl-as.nxtck.com/iab/img/ Frame 3E52 4 KB
4 KB 31ms
31ms Image
image/png 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-ssl-as.nxtck.com/iab/img/OBA_en.png
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623135668972789&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 835b8e7fce8c7030ab18fe28277589c21b062b5b6e6301939cb1e62b1af3f151

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
via: 1.1 google
last-modified: Tue, 02 Oct 2012 09:47:12 GMT
server: nginx
etag: "506ab820-108b"
content-type: image/png
accept-ranges: bytes
alt-svc: clear
content-length: 4235

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame FCB9 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.294017284;dc_ver=75.217;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=437876951;ord=oubwzd;click=http%3A%2F%2Fredirect.nxtck.com%2Fww-redirect%2FWwRedirectServlet%3Fp%3D1%26clicurl%3Dhttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs7D5tBW_YPWvO8Lq3wP24orYAujZ-shiwrXEvJsMyqel-ugOEAEgtKPufmD7gYCAiAqgAYW3uOIByAEJqQI9lO1u73G0PqgDAaoE5gFP0OpGZuQRxwiEiicxzcu-SCKBuaMe4m3ZPjY-clzCmMpW_E-ZftVdqwxr1iD82tq5U5F99bdfPlrI9fLW3zlo4lt4P-8mht7IbWr4vvI53GzoetsVh6yAffZW7QmlLT6ovfr10d4YlPxdCbCA5lpBbCYT0_kQNpNQ7M0Eo-SdJqYNTjfa9BjgzjNCroDgEHK8so8ejojEEUeOUdgC-ibmDi9zeoR2_7P0X8Sxa55mib3YGCiTKjdBShaMscmNKJwjbDof7iaWeFfreG055Ff_-CCt5iZ5xf271FgC15wUMAmdBTJzQsAE1qWPs6QD4AQDkAYBoAZNgAfjyMedAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT88rcC9ATANgTDdgUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoRpDDymTqUCn_gYAvzS1vQhXUzw%26sig%3DAOD64_3W3b3XuNDtUtPZVZsByOUs__AA5w%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-B8idr9uHs3H0_OHxsmYzZOf7HzTN8evSUUpEV2EIJt2y8Vam8bvatW45AxjnXSp8YtPYuYsWWsogns8RWq2M6c-HLtnllheObDtL8CxYIAs9xAGgzrW5KN4-l3iJUlrXj-aIgMV0Sj5rOseZyj3EJRcojY-w%26dbm_d%3DAKAmf-BOtA_OOoAyKpL4qmpzLSOhXs384wMUCdH6djZOLFc87xW-L1M7I_RYh2fIkUXOmV6_537gsP0ANw5uzK5vI66CxbqsqN2wxyWpV97MZg--irT0gdZEWe0adOw3F60RIrYFxRMKE2nXQTyvc-giCKwTVfxNzDdl8moEL8-GaYaU9i6mvOu4v5MHYXjP4bbIwMv6-TzKclvIHEx5_TkyZH6vxQ0m1mnYbay6WZEA1ZLIFu1Qwcpe0CL47zGWLFkjFvVimBSeTdRpzccdBUsqeqOT8_4wx33ar4RMMgNW9t1tk8E2lsP7opopsjWscxtdOsUupa1gL8VQTL0OyXCMfA6GymNrncM_FiaiFbRfNJ3RvoX7ZdkTOj96q0_wR4N_-VZKYU8gmmTS3mppruXHRH4A2t9NokMmNeAznhX5OppnmUAMVGSX5_ZPrNlw0mJ0LIRDWL1NQfKcsSo2_qIZqqruM7B4MA%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D581962%26ev%3D75873%26rid%3DP1_SupEJB2WWYNZ6%26sid%3D567755672%26uuid%3Df03f711d-a376-45f6-8776-22bd25cb5059%26ecr%3D%26referer%3Dhttps%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2Fd4a2c404a5e860967744fd97bb63cbfe.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=u'PXncxf90;osda=2;sttr=16;prcl=n

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:59:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:59:49 GMT

GET
H3-29 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame FCB9 111 KB
38 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ad.doubleclick.net
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 19:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42964
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Jun 2021 19:05:05 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FCB9 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:20:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2456
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Jun 2022 06:20:13 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 417A 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 07 Jun 2021 21:53:56 GMT
expires: Tue, 07 Jun 2022 21:53:56 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 32833
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FCB9 122 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 07:01:09 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:01:09 GMT

GET
H3-29 200 index.html Show response
s0.2mdn.net/9693237/1611151990508/ Frame C62F 43 KB
14 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9693237/1611151990508/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc2666cab0b3633b292f872b528529e4e96637d2a93e7dbc9b89e786a686c6af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9693237/1611151990508/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 13952
date: Mon, 07 Jun 2021 08:22:39 GMT
expires: Tue, 08 Jun 2021 08:22:39 GMT
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 81510
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCB9 0
23 B 59ms
59ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_La_w9tvAfXrT7N6Cyp7WLIycwg4jF6paZIef_Ty9JhBw8PVuzvFxEmZyy2U3FiR4sjyGT2TkDKWOO0Wy1ytwR5Ax-NRkOkqyIrveCFVmg-R_u0h4pVaf6b6XbPAhW9IfXU-Y4IAX_qv8fviM2wbucGIjXb2uEmeS2GbEWTQ&sig=Cg0ArKJSzA_KqV6P2BdeEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=40&cbvp=1&cstd=38&cisv=r20210603.68146&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 07:01:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 417A 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 63931
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 13:15:38 GMT

GET
H3-29 200 logo.png
s0.2mdn.net/9693237/1611151990508/ Frame C62F 3 KB
3 KB 6ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1611151990508/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1611151990508/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30c1380e5be52b90accb5f5329b2f3c4adc335df500c43b63a48f204809b7f76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1611151990508/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 08:22:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
server: sffe
age: 81510
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3115
x-xss-protection: 0
expires: Tue, 08 Jun 2021 08:22:39 GMT

GET
H3-29 200 text_01.png
s0.2mdn.net/9693237/1611151990508/ Frame C62F 4 KB
4 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1611151990508/text_01.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1611151990508/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2d0c1f2fdba47c0681424e4ddb23815d6671e1f5b14b7e2ee3d64e098c4184e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1611151990508/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 08:22:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
server: sffe
age: 81510
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3867
x-xss-protection: 0
expires: Tue, 08 Jun 2021 08:22:39 GMT

GET
H3-29 200 text_02.png
s0.2mdn.net/9693237/1611151990508/ Frame C62F 9 KB
9 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1611151990508/text_02.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1611151990508/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58aee178ebea3287f137a29cce7c93b31bf15853d4e9c4b40b89780fafd3f48f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1611151990508/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 08:22:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
server: sffe
age: 81510
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9630
x-xss-protection: 0
expires: Tue, 08 Jun 2021 08:22:39 GMT

GET
H3-29 200 text_03.png
s0.2mdn.net/9693237/1611151990508/ Frame C62F 7 KB
7 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1611151990508/text_03.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1611151990508/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5bddaa73f3de6729f08fd0a1385bbcd109bd8fa6a877dab20d47f385dfca10e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1611151990508/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 08:22:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
server: sffe
age: 81510
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7499
x-xss-protection: 0
expires: Tue, 08 Jun 2021 08:22:39 GMT

GET
H3-29 200 cta.png
s0.2mdn.net/9693237/1611151990508/ Frame C62F 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1611151990508/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1611151990508/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81e0d602126ecb5035db57aeb898c2fee841baecc9ed8d7c3f89ecc912fb3e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1611151990508/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 08:22:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 20 Jan 2021 14:13:10 GMT
server: sffe
age: 81510
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2058
x-xss-protection: 0
expires: Tue, 08 Jun 2021 08:22:39 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCB9 0
23 B 58ms
58ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS