bg.medicinestars.com Open in urlscan Pro
172.67.220.23 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bg.medicinestars.com/
Effective URL:
https://bg.medicinestars.com/
Submission: On August 21 via manual (August 21st 2022, 7:23:32 pm UTC) from BG — Scanned from DE

Summary HTTP 118 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 34 IPs in 8 countries across 28 domains to perform 118 HTTP transactions. The main IP is 172.67.220.23, located in United States and belongs to CLOUDFLARENET, US. The main domain is bg.medicinestars.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 4th 2022. Valid for: a year.

This is the only time bg.medicinestars.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 23	172.67.220.23 172.67.220.23	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:206... 2600:9000:206f:ca00:11:a4de:2580:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	151.101.65.195 151.101.65.195	54113 (FASTLY) (FASTLY)
23	104.21.38.78 104.21.38.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1 2	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
3 7	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
1	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:20:... 2606:4700:20::ac43:4bf1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2.21.184.247 2.21.184.247	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
1 5	104.18.18.126 104.18.18.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	66.155.71.25 66.155.71.25	13768 (COGECO-PEER1) (COGECO-PEER1)
1 1	154.59.122.79 154.59.122.79	174 (COGENT-174) (COGENT-174)
2 2	135.125.160.160 135.125.160.160	16276 (OVH) (OVH)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1	2606:4700::68... 2606:4700::6812:d4c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
118	34

23 172.67.220.23 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bg.medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:ca00:11:a4de:2580:93a1 (United States)

ASN16509 (AMAZON-02, US)

get.optad360.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.65.195 (United States)

ASN54113 (FASTLY, US)

cdn.zx-adnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 104.21.38.78 (None, )

ASN13335 (CLOUDFLARENET, US)

img.medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bg.medicinestars.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.204 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

site2text-2021.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4bf1 (United States)

ASN13335 (CLOUDFLARENET, US)

script.4dex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.19.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

faq.worldtourismgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.184.247 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-184-247.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.130.91 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.18.18.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.155.71.25 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.59.122.79 (United States) 1 redirects

ASN174 (COGENT-174, US)

ums.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 135.125.160.160 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: ns3198892.ip-135-125-160.eu

gu.dyntrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:d4c (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	medicinestars.com 1 redirects bg.medicinestars.com medicinestars.com img.medicinestars.com	804 KB
22	googlesyndication.com 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 159 pagead2.googlesyndication.com — Cisco Umbrella Rank: 123	172 KB
9	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 218 googleads.g.doubleclick.net — Cisco Umbrella Rank: 52 cm.g.doubleclick.net — Cisco Umbrella Rank: 214	201 KB
8	casalemedia.com 2 redirects htlb.casalemedia.com — Cisco Umbrella Rank: 539 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 456 r.casalemedia.com — Cisco Umbrella Rank: 778 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 525	8 KB
7	zx-adnet.com cdn.zx-adnet.com — Cisco Umbrella Rank: 185549	134 KB
5	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 10960	2 KB
4	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 407 mug.criteo.com — Cisco Umbrella Rank: 2790	1 KB
4	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 88 www.google.com — Cisco Umbrella Rank: 9	1 KB
2	dyntrk.com 2 redirects gu.dyntrk.com — Cisco Umbrella Rank: 1307	850 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 282	1 KB
2	indexww.com js-sec.indexww.com — Cisco Umbrella Rank: 594 cdn.indexww.com — Cisco Umbrella Rank: 1405	2 KB
2	4dex.io script.4dex.io — Cisco Umbrella Rank: 2218	24 KB
2	yandex.ru 1 redirects mc.yandex.ru — Cisco Umbrella Rank: 3880	71 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9849	1 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 727	83 KB
2	optad360.io get.optad360.io — Cisco Umbrella Rank: 27697	549 KB
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 792	425 B
1	acuityplatform.com 1 redirects ums.acuityplatform.com — Cisco Umbrella Rank: 1330	637 B
1	sitescout.com pixel-sync.sitescout.com — Cisco Umbrella Rank: 602	191 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 371	265 B
1	gstatic.com fonts.gstatic.com	16 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	1 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 194	44 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 8811	792 B
1	worldtourismgroup.com faq.worldtourismgroup.com	629 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 422	2 KB
1	web.app site2text-2021.web.app — Cisco Umbrella Rank: 376859	431 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 615	78 KB
118	28

	Domain	Requested by
34	img.medicinestars.com	bg.medicinestars.com
14	tpc.googlesyndication.com	bg.medicinestars.com 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com tpc.googlesyndication.com securepubads.g.doubleclick.net
7	cdn.zx-adnet.com	bg.medicinestars.com cdn.zx-adnet.com
7	medicinestars.com	bg.medicinestars.com medicinestars.com
6	pagead2.googlesyndication.com	tpc.googlesyndication.com www.googletagservices.com securepubads.g.doubleclick.net
5	dsum-sec.casalemedia.com	1 redirects r.casalemedia.com
5	mc.yandex.com	2 redirects bg.medicinestars.com
5	securepubads.g.doubleclick.net	get.optad360.io securepubads.g.doubleclick.net bg.medicinestars.com
5	bg.medicinestars.com	1 redirects bg.medicinestars.com
3	www.google.com	1 redirects bg.medicinestars.com tpc.googlesyndication.com
2	gu.dyntrk.com	2 redirects
2	cm.g.doubleclick.net	1 redirects r.casalemedia.com
2	s.amazon-adsystem.com	1 redirects r.casalemedia.com
2	mug.criteo.com
2	gum.criteo.com	1 redirects
2	googleads.g.doubleclick.net	44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
2	44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	script.4dex.io	get.optad360.io script.4dex.io
2	mc.yandex.ru	1 redirects bg.medicinestars.com
2	counter.yadro.ru	1 redirects bg.medicinestars.com
2	maxcdn.bootstrapcdn.com	bg.medicinestars.com maxcdn.bootstrapcdn.com
2	get.optad360.io	bg.medicinestars.com get.optad360.io
1	cdn.indexww.com	r.casalemedia.com
1	ad.turn.com	1 redirects
1	ums.acuityplatform.com	1 redirects
1	pixel-sync.sitescout.com	r.casalemedia.com
1	match.adsrvr.org	r.casalemedia.com
1	r.casalemedia.com	js-sec.indexww.com
1	ssum-sec.casalemedia.com	1 redirects
1	js-sec.indexww.com	get.optad360.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	tpc.googlesyndication.com
1	www.googletagservices.com	44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	faq.worldtourismgroup.com	cdn.zx-adnet.com
1	htlb.casalemedia.com	get.optad360.io
1	cdn.jsdelivr.net	get.optad360.io
1	site2text-2021.web.app	bg.medicinestars.com
1	code.jquery.com	bg.medicinestars.com
118	40

This site contains links to these domains. Also see Links.

Domain
medicinestars.com
ar.medicinestars.com
cs.medicinestars.com
lang-dan.medicinestars.com
lang-gre.medicinestars.com
es.medicinestars.com
et.medicinestars.com
fi.medicinestars.com
fre.medicinestars.com
hi.medicinestars.com
hr.medicinestars.com
hu.medicinestars.com
lang-ind.medicinestars.com
lang-ita.medicinestars.com
he.medicinestars.com
ja.medicinestars.com
lang-kor.medicinestars.com
lt.medicinestars.com
lv.medicinestars.com
ms.medicinestars.com
nor.medicinestars.com
lang-pol.medicinestars.com
lang-por.medicinestars.com
ro.medicinestars.com
ru.medicinestars.com
sk.medicinestars.com
sl.medicinestars.com
lang-sr.medicinestars.com
lang-swe.medicinestars.com
lang-tha.medicinestars.com
tr.medicinestars.com
uk.medicinestars.com
lang-vie.medicinestars.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-04` - `2023-06-03`	a year	crt.sh
*.optad360.io Amazon	`2021-11-17` - `2022-12-15`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
www.emilnichita.com GTS CA 1D4	`2022-07-22` - `2022-10-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2022-05-21` - `2022-10-31`	5 months	crt.sh
web.app GTS CA 1D4	`2022-08-12` - `2022-11-10`	3 months	crt.sh
qdd.itdd.app GTS CA 1D4	`2022-07-04` - `2022-10-02`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-06-15` - `2022-09-18`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.sitescout.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2021-12-15` - `2023-01-15`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://bg.medicinestars.com/
Frame ID: 1CB710362EA1526D991E120D39D3674B
Requests: 77 HTTP requests in this frame

Frame: https://bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=73e5be36f83eb398
Frame ID: A55A31D650C2DDFF6766C9605D56940D
Requests: 3 HTTP requests in this frame

Frame: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 90A81ACA689EC83C040E041BA4244D39
Requests: 1 HTTP requests in this frame

Frame: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B72740BA0DFBB178B68EC269376F6C8F
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html
Frame ID: FBD8D6BA66C3EE1E1A0909FA9DC0B04B
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 92E2D015CB4F60097E732FCF8117368F
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: FC0033BF6AC810129F7F4C16FE092F31
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 59760122452115C3C8C00B31F271F236
Requests: 2 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 8AEF63AB1EEE481A022312C0DE7D7E17
Requests: 1 HTTP requests in this frame

Frame: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Frame ID: BA4A99A7E35CF193978B8DE87DC283EA
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Съвременните Методи На Лечение, Медицински Изследователски Статии, Методи На Лечение 2022, Август

Page URL History Show full URLs

http://bg.medicinestars.com/ HTTP 301
https://bg.medicinestars.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

118
Requests

92 %
HTTPS

56 %
IPv6

28
Domains

40
Subdomains

34
IPs

8
Countries

2191 kB
Transfer

5621 kB
Size

30
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: https://medicinestars.com/

Search URL Search Domain Scan URL

URL: https://ar.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://cs.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-dan.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-gre.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://es.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://et.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://fi.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://fre.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://hi.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://hr.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://hu.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-ind.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-ita.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://he.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://ja.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-kor.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lt.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lv.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://ms.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://nor.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-pol.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-por.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://ro.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://ru.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://sk.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://sl.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-sr.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-swe.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-tha.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://tr.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://uk.medicinestars.com/

Search URL Search Domain Scan URL

URL: https://lang-vie.medicinestars.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bg.medicinestars.com/ HTTP 301
https://bg.medicinestars.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://counter.yadro.ru/hit?r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052 HTTP 302
https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052

Request Chain 66

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9737.MuJdpzi_pBaj4Ny3pDDtcuXbValAJDqzUfS2aT0HMRAw9A_7BkXPXr0k1gVipxFZ.rmFKL6lqGg-gdWnHU9EnrA2t1vY%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9737.m_b7fthm6KwrnzHmlwUDIOATP9VJ82v4Ir6mKrqJS3M-zLIAlUN8SduFZV_pHs0ZUyokLrgDhTRqlzSLITq01Q%2C%2C.7LWfBk6yOZMTaVTK5nTDYrVDyhw%2C

Request Chain 73

https://mc.yandex.com/watch/61431538?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A870%3Acn%3A1%3Adp%3A0%3Als%3A300202268802%3Ahid%3A676630161%3Az%3A0%3Ai%3A20220821192325%3Aet%3A1661109805%3Ac%3A1%3Arn%3A1067787064%3Arqn%3A1%3Au%3A16611098051023180886%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1661109804472%3Ads%3A0%2C57%2C71%2C1%2C93%2C0%2C%2C527%2C15%2C%2C%2C%2C750%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1661109806%3At%3A%D0%A1%D1%8A%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%B8%D1%82%D0%B5%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%2C%20%D0%9C%D0%B5%D0%B4%D0%B8%D1%86%D0%B8%D0%BD%D1%81%D0%BA%D0%B8%20%D0%98%D0%B7%D1%81%D0%BB%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%81%D0%BA%D0%B8%20%D0%A1%D1%82%D0%B0%D1%82%D0%B8%D0%B8%2C%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%202022%2C%20%D0%90%D0%B2%D0%B3%D1%83%D1%81%D1%82&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)rqnl(1)ti(2) HTTP 302
https://mc.yandex.com/watch/61431538/1?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A870%3Acn%3A1%3Adp%3A0%3Als%3A300202268802%3Ahid%3A676630161%3Az%3A0%3Ai%3A20220821192325%3Aet%3A1661109805%3Ac%3A1%3Arn%3A1067787064%3Arqn%3A1%3Au%3A16611098051023180886%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1661109804472%3Ads%3A0%2C57%2C71%2C1%2C93%2C0%2C%2C527%2C15%2C%2C%2C%2C750%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1661109806%3At%3A%D0%A1%D1%8A%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%B8%D1%82%D0%B5%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%2C%20%D0%9C%D0%B5%D0%B4%D0%B8%D1%86%D0%B8%D0%BD%D1%81%D0%BA%D0%B8%20%D0%98%D0%B7%D1%81%D0%BB%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%81%D0%BA%D0%B8%20%D0%A1%D1%82%D0%B0%D1%82%D0%B8%D0%B8%2C%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%202022%2C%20%D0%90%D0%B2%D0%B3%D1%83%D1%81%D1%82&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29

Request Chain 88

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 102

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fbg.medicinestars.com%2F&domain=bg.medicinestars.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=P7FZnXxYZW5ZeVo0dW1qa0FNd0txbDJjNkFtaXhIeUVtOWl5M1NWdkcyV21HTER2cE9BWGhWLzRRdXBsQkZzendaK0JiZGJWWkFycUQvNlRxZVlIS1FGNnJQa3BnUXFiVEE1YmNFQmVERTQxN2Y5WHFNN2txK2VaMm8vM3BPT3YyMWdYSTZsbGltSE11aEdLU20xd0wvOXRiUG0zZXZMa2pPZkNVeEFXYmprQkNpb2pBd25VWmE2N0VNVmlrMEpVWTlDbEFKVDYxYXBPdGNhejR4OGRKNjlyNDJUc0lEcUsvcmFsSllheGIwVHhLdHBuQW9WQm9HVmtGRnQvd1pBZ0ZCeFVafA&cppv=2

Request Chain 105

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP 302
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Request Chain 108

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB&dcc=t

Request Chain 109

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YwKGMJ8FcvOXZwSCygAiTAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK_x3SmQfBTXAG7j_eO97uo&google_cver=1&gdpr=1

Request Chain 113

https://ums.acuityplatform.com/tum?umid=8 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=687651033622

Request Chain 114

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1 HTTP 302
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

Request Chain 115

https://ad.turn.com/r/cs?pid=21&gdpr=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2604101102979081207

118 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
bg.medicinestars.com/
Redirect Chain

http://bg.medicinestars.com/
https://bg.medicinestars.com/

67 KB
11 KB

129ms
71ms

Document
text/html

172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be3cec4985947de27bff90e08dba36fda4e4d1013bbc741f521185c0630d527e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=86400
cf-cache-status: DYNAMIC
cf-ray: 73e5be36f83eb398-MUC
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 21 Aug 2022 19:23:24 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Mon, 22 Aug 2022 19:23:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QcKQ%2BHiyWpZsUupsb8oNckGx0%2FS2UYCQGnHVxiAnrLfCaj%2BlXnx7tGlFxu2nIE1r199V%2FZ1qymAU4dL3k5gTZARFFlzhWiLeiMe8k%2BNvypetkphFnwarhssXiEYQxfp762Mq0Io3CQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

CF-RAY: 73e5be36598bb39d-MUC
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sun, 21 Aug 2022 19:23:24 GMT
Expires: Sun, 21 Aug 2022 20:23:24 GMT
Location: https://bg.medicinestars.com/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ctq0se%2B%2BHM4pJQSsLC%2FZoqyP3%2B7FTOpEJh%2ByhGG%2BwtOCLx2llDrBOmflAM9DcxO6Q4Pda4P3wfzjVbUMGNe8cwA%2BtOVRzBLWgTl7r8%2Bl94CcURoBYylHHg1XzroWjf65FzwXLBPugw%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/29c44d7c-8171-46d6-a484-9d3087559448/ 373 KB
88 KB 114ms
26ms Script
application/javascript 2600:9000:206f:ca00:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/29c44d7c-8171-46d6-a484-9d3087559448/plugin.min.js
Requested by: Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ca00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 920bf5e0981c083ac0cc65869559295260817baa40cdd79fd293fa7d7acf5456

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:00:31 GMT
content-encoding: gzip
last-modified: Thu, 10 Mar 2022 12:36:00 GMT
server: AmazonS3
age: 1374
etag: W/"588fa2466d71b4d118fdf3af043b05a4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: yrp4X1bDZd37DbFxx5x5nCHnp4LP6IMrW2A22lQc6ueU5_9tOBbF-Q==

GET
H2 200 jquery-3.2.1.js Show response
code.jquery.com/ 262 KB
78 KB 115ms
65ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.js
Requested by: Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9027289ffa5d9f6c8b4e0782bb31bbff2cef5ee3708ccbcb7a22df9128bb21

Request headers

Referer: https://bg.medicinestars.com/
Origin: https://bg.medicinestars.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-41707"
vary: Accept-Encoding
x-hw: 1661109804.dop143.fr8.t,1661109804.cds230.fr8.hn,1661109804.cds221.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 79082

GET
H2 200 logo-32x32.png
medicinestars.com/template/images/ 1 KB
2 KB 41ms
37ms Image
image/png 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://medicinestars.com/template/images/logo-32x32.png

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d1b30d734ca1985b158a2f966d6cd90b241727d104f94d72062a4a997208405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 15601228
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1421
last-modified: Mon, 27 Jan 2020 17:54:00 GMT
server: cloudflare
etag: "58d-59d22cac65e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MaO8gKABY7%2FRXw3uPYOdufzYDUuyS%2FdBns2U1Dj3ILnV8r6056YADDELyXp5YykjDwLusBy%2FMgwmSPhxBUUgHrP2N5KA8LTqNmGjhdJiabgEQd%2BZPPd1Rfec9lB9Eo1xYkkxww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be388b15b398-MUC
expires: Wed, 22 Feb 2023 05:42:56 GMT

GET
H2 200 health_logo_mobile.png
medicinestars.com/template/img/ 15 KB
16 KB 40ms
36ms Image
image/png 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://medicinestars.com/template/img/health_logo_mobile.png

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3665713c8449f0eb6669b4473fdf731b92c0e36bc790b70aed83f992863f4130

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1547253
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15768
last-modified: Mon, 27 Jan 2020 17:54:00 GMT
server: cloudflare
etag: "3d98-59d22cac65e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LnXll0zHutDV%2Bui9vIb32I2oDTjTqq8v55zYYgvewsl3NpWgEzghGdHrZ9V3ADQ5%2Bjy41vE%2FWhekIJnGY3M%2BfCzKSV0UmC6rwhz5jF7s%2FNRvxXxYwZc0QbGPPjV3krefv0qP%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be388b17b398-MUC
expires: Thu, 03 Aug 2023 21:35:51 GMT

GET
H2 200 style.min.css
medicinestars.com/template/css/ 244 KB
52 KB 56ms
39ms Stylesheet
text/css 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medicinestars.com/template/css/style.min.css

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

741b4c29522df6ef52528107450be650cd3b92fcb52b659e9ff0a49e40e3e730

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1070088
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 29 Jan 2021 20:26:15 GMT
server: cloudflare
etag: W/"3cf68-5ba0fd0e6e5c8-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=so%2BoYSBxCw45fvJWGzOjwx7v2g18OZM%2Fi64%2BUyGB2yrvgQIsJQaQtrXqE0Jl0e8XmnH4okUJ17RiPzHMczYHIsgPKJbd4YK1urKjyVgp8G5OHGDh9p4MR8fuyRyQUvKIaMacaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=1209600
cf-ray: 73e5be388b12b398-MUC
expires: Tue, 23 Aug 2022 10:08:36 GMT

GET
H2 200 main.min.css
medicinestars.com/template/css/ 924 KB
119 KB 67ms
63ms Stylesheet
text/css 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medicinestars.com/template/css/main.min.css

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5572bb73e63e040969714fcc2a6519fa71e062fead143959cf7688193c0a6bd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1070356
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 29 Jan 2021 20:26:15 GMT
server: cloudflare
etag: W/"e6e98-5ba0fd0e927e9-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sr1jqrMfnvj0uRmzjo81YDIKh0q%2BGvq0oEjqpB5crZjZ8lbt3pB14v7M5xEPyFV7zwyodqr0aGIV7ZwhuxubqNmET8mpJra8AN1uyMKLU%2FcM7EuVyut9LHuJrcB9rupbQVOyuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=1209600
cf-ray: 73e5be388b13b398-MUC
expires: Tue, 23 Aug 2022 10:04:08 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 79ms
28ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723
age: 18335477
cdn-cachedat: 11/15/2021 21:49:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 8b677d48aa464c28c0815c97adbbe174
cf-ray: 73e5be38ccac6903-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 main.js Show response
medicinestars.com/template/js/ 553 KB
158 KB 68ms
65ms Script
application/javascript 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medicinestars.com/template/js/main.js

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64c03414e898ee258c61921bbdd483d1c0f3b4e76949f94c129193f4624cbce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 307281
cf-polished: origSize=566660
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Sep 2022 06:02:03 GMT
last-modified: Fri, 19 Oct 2018 21:00:00 GMT
server: cloudflare
etag: W/"8a584-5789b2fc11400-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BxM%2BVDjZBmrVXSMufyxEWi6AXrDe0u0lURGwYOjaGVOe1GP5oxnqsLo6an7Ln%2FoNrYKZ%2FiFZfDvIW5JYWtdh7uzM85evJoB5b6CsizaxOHlY748wJ%2F6lFO8LdZADaiF8dlYdRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=1209600
cf-ray: 73e5be388b16b398-MUC
cf-bgj: minify

GET
H2 200 optr21_19091901.js Show response
cdn.zx-adnet.com/adx/ 147 KB
20 KB 122ms
21ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/adx/optr21_19091901.js

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c12395451dd35e7f1feb3e75840752f393e690cfe90019b8596e0358c0b9a26d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
etag: "8d667337f4b47f19e2bec17c6b3da3ea299231ef64ae69dbf0b8eacded0e31a3-br"
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20001
x-served-by: cache-hhn4026-HHN
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.980560,VS0,VE0
date: Sun, 21 Aug 2022 19:23:24 GMT
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600,public
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive
x-cache-hits: 2

GET
H2 200 cookies_gdpr.js Show response
cdn.zx-adnet.com/consent/ 34 KB
9 KB 160ms
59ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/cookies_gdpr.js?0.5556525583059113

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6723ea2989d5cf57335b26d5bd0bcc52feffab866915b917c4cdcae672c99a2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.980563,VS0,VE40
etag: "e816600dd00bd96b1fef78362730b72e57d5bac88839b4da007d48db85d79519-br"
x-served-by: cache-hhn4026-HHN
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: no-cache
date: Sun, 21 Aug 2022 19:23:25 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache-hits: 0

GET
H2 200 hyperglycemia-symptoms.jpg
img.medicinestars.com/img/news/420/ 12 KB
13 KB 85ms
74ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/420/hyperglycemia-symptoms.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06a75edfd3dc41cda52912c763150e03229959984e855ef670426dc8f6f410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12596
last-modified: Fri, 29 Nov 2019 00:59:34 GMT
server: cloudflare
etag: "3134-59871be42a27b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RT4iQXqM%2FSEWs1aQQCeVmZppCkNLcnP9QzLrJRk%2FmLl1td1x7e5WvUB2dSVo9rnxiM0gFOnc%2BFkZqfBcinBbCF02G6MSS8ZgsyDm6N5sj5jbpkFg%2FC8BeLm1VVQfWhoyXW8cA1c7J7I%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38ab3db398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 renova-0-02.gif
img.medicinestars.com/img/news/382/ 10 KB
10 KB 68ms
66ms Image
image/gif 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/382/renova-0-02.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38e136890d4ebf25d95eec324126f4a623c8d1cef597b97a2411cde6cdaeeaef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9830
last-modified: Fri, 29 Nov 2019 00:59:16 GMT
server: cloudflare
etag: "2666-59871bd2f1f36"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vACELf6PQp2YyM64Yp%2B1raYoVhO6zpOjnhhFxgpZZtK7d5rcng6JFX5w2eJanDdNd05stxJw8aId1cajUPvb9fzSzPe8GwYrqMnIv%2FTb%2B08bP%2BcbMHjuIXCADCcWUbNRFFAcaiVsndU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38bb5bb398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 retin.gif
img.medicinestars.com/img/news/744/ 7 KB
8 KB 69ms
68ms Image
image/gif 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/744/retin.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3813da7176a62efec0309d6c5082e37fc441bd83892f153b1571ba94972616dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7486
last-modified: Fri, 29 Nov 2019 01:02:12 GMT
server: cloudflare
etag: "1d3e-59871c7b02630"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3WNWMhtHxVtHWHJ2TE83Yl%2F%2BSATiGxEeRMSn63Bg08O%2F3Gq6UigmrIXY1Gy9QdmFVj%2BrMxPddO%2F03rFhCfUMo1yZ%2BUl%2FxoNrUfSZ8Sb5XUg7cJ5G5tU8qwNXZlCS3gPIYuOyY7Hd1d4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38bb5db398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 retin-micro.gif
img.medicinestars.com/img/news/438/ 17 KB
18 KB 91ms
91ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/438/retin-micro.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y3XQCHMd0PPNJvtOpflJ%2F9Fhh03%2FZkZU%2BKrBaTx9Ps%2BUvQKecVgQ0MFuzC7pL0BK3kPAOjufIqPcz8GVJDDcaZ8bbikxucJaS7TnCqPMTQaXYOtIOzHormtfY9FaVTXz7scc0ToT6Z0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38bb60b398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 revonto.gif
img.medicinestars.com/img/news/855/ 4 KB
5 KB 84ms
83ms Image
image/gif 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/855/revonto.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f30ec3067a19932bdd2bdaa6387046b00b6ee49d55a5129a34f16d5c859c33fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4387
last-modified: Fri, 29 Nov 2019 01:03:18 GMT
server: cloudflare
etag: "1123-59871cba1abe6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O0%2Bw8Px7tIxji0UuPOl%2FqQDe7NH9klj27hvFn3Aa0e68L7OqOcBdQPVuzZCE21GKf8ExvXmdNSC5%2FnVdbQ7%2By1Cs2f77g%2BAjUBTJbH9l%2FiClru3SJYYe9ZSJX8ReUQbLYEQh3Xz3VTA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38bb61b398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 butterbur.jpg
img.medicinestars.com/img/news/587/ 17 KB
18 KB 91ms
90ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/587/butterbur.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:24 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YyhLQeDCmxQ9DZdNVFRHGOu%2BtjePFEUyEblm7wRkTCnWlQoXDnG6FslWkv8FSuhgwUxldOjhWNZRGpALhyvtxUsur4Gmzs94rudUUAjoIG79fJcgzG5ctW1wahbE%2Bp19qIt%2Brqgq%2FsI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be38cb78b398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 concussion-faqs.jpg
img.medicinestars.com/img/news/147/ 17 KB
18 KB 85ms
80ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/147/concussion-faqs.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fbqaz93r7PQfH9sV5k0%2Fwl3LGt57CIcijBNsgfbvIkbC5x3SfjM2k99b32j61qNb9VbmZrPcpxUMqR54Qqw2kOABBk9EBm6T7RUex95hn6Jvyy4k1gcj4N2a9EU4QtVDCCxP6d4cGQE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c08b398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 10-facts-about-amazing-brain-faqs.jpg
img.medicinestars.com/img/news/124/ 5 KB
6 KB 70ms
65ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/124/10-facts-about-amazing-brain-faqs.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5c482d8a44f8456aff84b0afd5dd59ea494e8497dfdb9822dbe649972faf0cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5192
last-modified: Fri, 29 Nov 2019 00:57:04 GMT
server: cloudflare
etag: "1448-59871b554edd5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bIWRmfVlTjejrnCl4R0IjjkOyIV2Xv3AkBVKh88X5MfVrKYOiaWq%2BbLYEPI7FcTfk6WTKLGrIUMpIXHwZNobTI2TJUfEUXi7jwaloez5n1IscqRI4h%2BuoP96fkZl3pjj9PwQJdu%2Bjio%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c0bb398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 soybean-oil.jpg
img.medicinestars.com/img/news/406/ 17 KB
18 KB 86ms
81ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/406/soybean-oil.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FuCEgowJQAN%2Fp922TmtQSlqsjMeVFPdDUgar%2BYehJVvLi1PivRce01%2FL1K6dCiGQI1U1guROim5YMcJ1XqkBRgZBwANebkmNsBD0mIWH6JtzsI44wK9ozYeI5Tvltf7zSr83TgRdU9I%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c0db398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 schisandra.jpg
img.medicinestars.com/img/news/780/ 17 KB
18 KB 984ms
980ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/780/schisandra.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gwk4Z3PsuE6SG%2BJMG%2Bu1VT36zD%2BNxDsyTRlj9l9Dt3%2B6srdzCgW86lYnwVHcFIka7D7uV7gPr5jewyXJ6406d5RJcNwL6lxw%2BgQNvyUKBq2cVsFkD33HarpN3V%2FH7M8IXMIJ1H2Ni0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c0fb398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 wild-cherry.jpg
img.medicinestars.com/img/news/698/ 17 KB
18 KB 85ms
81ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/698/wild-cherry.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cidUiSvQApkmw2VIq1Yvr5usj2OUEqfMJ2yKrOnhBvwEQHBcDLpudZYMqTQzvHvVHiTnzvlx1qPbZEybZy14Xc5fXvPkvaQP5YOKcYQT1XSy3EICBTfMRY4pgxNxn7JTZRU2AU6OZIo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c10b398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 cesium.jpg
img.medicinestars.com/img/news/490/ 17 KB
18 KB 56ms
52ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/490/cesium.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AujRXDXkg%2BZNTMnsN5voLZNRpYyl56wh2AExzTd6Yu6lwcaHIdNPwnfoomchk%2BwpdLrxapXJqBnZM9hIHPQCBYAIZluejKwTR8TpLoeE3pj82gm3DbqNyuvAwLc9K9Y6nQwSwc2e9YI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c12b398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 beeswax.jpg
img.medicinestars.com/img/news/463/ 17 KB
18 KB 79ms
75ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/463/beeswax.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d%2BHzxtT7CDWJCiQninApYDI8mPYVrycgdB%2B1K7xNyXBYjG8g%2BkiMfQTUt8j7QOT6sbFhWasu54%2BbwEZqKMrX%2FDy%2B0bs7mQmYCY%2B5xhBiDWwugPJfrVpSNvpLClrPZZ6JFaxDG3CaTmI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c13b398-MUC
expires: Mon, 21 Aug 2023 19:23:24 GMT

GET
H2 200 phosphatidylcholine.jpg
img.medicinestars.com/img/news/980/ 17 KB
18 KB 91ms
87ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/980/phosphatidylcholine.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4BHCEbTTBU8JPRz93Bw%2BS%2FPTj%2BzeC5E5I0FxRMdP4sFBRm194sg%2BauG0ZZUPyD%2BMVlIOSqpiVbxWgY7ul5G2lLxOAw%2BBHFhUUhBa81B78od2ZDZQlDyPJg9rqI7OAGbXQT7Wjm%2Fvb5c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c14b398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
H2 200 lactoferrin.jpg
img.medicinestars.com/img/news/615/ 17 KB
18 KB 1332ms
1328ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/615/lactoferrin.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DzLUPhrSgbVVqi8V%2F4yTvP2W3%2FAVMh%2FIuA9gGu6HCDVEhu%2FkahU9znRSqhsGsbjjlsScD5%2BuzimjxIn64QEz4odDw949Xlrsw9IGEGB%2BMrmCFypWNr3JmPbp268OeoosOwkup2Eenoo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c16b398-MUC
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H2 200 atlantic-cedar.jpg
img.medicinestars.com/img/news/569/ 17 KB
18 KB 90ms
86ms Image
image/jpeg 172.67.220.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/569/atlantic-cedar.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.220.23 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZRruTquPZP7lALrNUDTkVSEWUGVG1YNAmq4y6MYgoWCAwApM9xufoL9LlX9QjlW63sLCbEA%2FvG8%2BA0yuQpqRKQv1nqer%2F9WS4gepoPbWBdsGqBBLctTLfNRXCfWU8dI6LTcqtMy16Xk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be392c1bb398-MUC
expires: Mon, 21 Aug 2023 19:23:25 GMT

GET
DATA 200
OK truncated
/ 19 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae2b3292ce4d22938259dd7e2d411ef3e498276837fbcc0475af40237b608f1f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 peanut-oil.jpg
img.medicinestars.com/img/news/262/ 17 KB
18 KB 2621ms
2620ms Image
image/jpeg 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/262/peanut-oil.jpg

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17642
last-modified: Thu, 28 Nov 2019 21:14:51 GMT
server: cloudflare
etag: "44ea-5986e9a9e9fb2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QWFhlE42BaeyXUpbS%2FUVF0PZ0jqI1hzdZveX8DX5Koh0xxpROulSrcaFC7QEPgOsmYoSa%2BRcfGg0EmRXMrpqP3kALS83gecPiIcyJbOD7z2X4G4NKWgycK4%2BZ%2FfOq%2FE3ODBd%2BwGiytA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3958ab9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 20-tips-beat-insomnia.gif
img.medicinestars.com/img/news/333/ 43 B
655 B 2014ms
2011ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/333/20-tips-beat-insomnia.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 00:58:51 GMT
server: cloudflare
etag: "2b-59871bbaf8410"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zKs3JpOW41v0r3jIjvkRiXoGsmdJN7KTBwGGDsGGO8DYe9%2BF9ZMscnzBzEIZ778y5KVu7Rnf%2FJskNpxrdR%2BKIsD6E1timJ0jWD%2BPzj8DPZF5QKEr%2BSPgkwki4AB8DZcTMfFchjUTb%2F0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b19bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 migraine-headache-hacks.gif
img.medicinestars.com/img/news/410/ 43 B
650 B 2368ms
2365ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/410/migraine-headache-hacks.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 00:59:28 GMT
server: cloudflare
etag: "2b-59871bdec0699"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xl8XjLZz4%2BO2XMOel3cp60SP3SMg82g2ywTGxacEIZi%2Fgki81H7xjJkLEIVwtB1YoDpLBfoEzqyMf4EacMhpRcmJeG2mLM6IxV01h8rlDtp%2BB%2BIaiDo6jIZx7uOrtLmZ4PQx2mcmoAA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b29bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 tips-traveling-when-you-have-back-pain.gif
img.medicinestars.com/img/news/525/ 43 B
653 B 2277ms
2274ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/525/tips-traveling-when-you-have-back-pain.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 01:00:25 GMT
server: cloudflare
etag: "2b-59871c14d42ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HOXBb10O5LpPqAGzgUHUjr4jRqx1fj4wyOpuP6XJj0P3QcGkXV0NZM%2FilG0Mj5hqQsnZEVmjchsxUaGarPrvU9xbb73vni2E779a9sI%2FSVK6iSUVbZqUTc96b%2FB41E%2Bk2GvKM7sI%2Fx8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b49bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 truth-behind-hangover-cures.gif
img.medicinestars.com/img/news/618/ 43 B
655 B 2643ms
2640ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/618/truth-behind-hangover-cures.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 01:01:03 GMT
server: cloudflare
etag: "2b-59871c39abd02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpxZ%2BGNct1XyPI%2Fr5qvI%2F2N%2F5L9HnS6Ir6%2Bkh72qMOAFHXEYb61kGJ7u52lYVp90OMSJB%2BomciAt2DVgVhRYODhaQ3wbgW598sKu8HdiPNERFII4WN%2BvzeghtbsFUZPPm0Pc6l7Tb74%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b69bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 what-does-it-mean-when-your-whole-body-aches.gif
img.medicinestars.com/img/news/854/ 43 B
653 B 1337ms
1334ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/854/what-does-it-mean-when-your-whole-body-aches.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 01:03:18 GMT
server: cloudflare
etag: "2b-59871cb9b2406"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ubXzdDC4W%2BDp%2BtuPJ%2FhWM51xfsxoaQIb2vQZVBQ8VXZvSGjT17tJ42lVhmlNIW7a4L8wyKw%2FgLg6ecu3NNeVlWWJSuKTy4pnW6004%2FlJMXwiGY3uOXPyZUwmz8v78KYsE10yjr8Z2qs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b79bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 low-testosterone-treatments.gif
img.medicinestars.com/img/news/638/ 43 B
647 B 1340ms
1337ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/638/low-testosterone-treatments.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
last-modified: Fri, 29 Nov 2019 01:01:16 GMT
server: cloudflare
etag: "2b-59871c45a05ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=62ZKDgVQoLM38a6l8QXN3oJ9czOgaFhj5EsoTF0ctGGuRbxkI1HbbYz9PUo6W%2B7ib88PiyYgdktXQycL4OnL9QBEG%2F3G6bVOpSUAhh4VBU66mjgeToOoWP91gDofsYanTY6ozhl8loI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968b99bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 osmolex-er.gif
img.medicinestars.com/img/news/418/ 8 KB
9 KB 2410ms
2407ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/418/osmolex-er.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

826dd094ec1f2f1eb3b71433722bb3a5f3171153e74bd0b9a754886d10a4acf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8458
last-modified: Fri, 29 Nov 2019 00:59:33 GMT
server: cloudflare
etag: "210a-59871be2f39ba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cQT1XANFdXo12voxno%2FvY%2Fmm0C0ItWDEL2%2BSXcnU1x0Tq64l1d6e2gmaYK%2BHCTjonHU1CQx4aaBC2jLvbDZOkYZIfC%2BjbeAiM%2BvFlgu7TdOP%2FSnQ%2F3mLS75vkvAlLRMFLkQvnMQo19o%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968bc9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 symmetrel.gif
img.medicinestars.com/img/news/388/ 3 KB
3 KB 1389ms
1387ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/388/symmetrel.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bda12b021bd92684a9ccabe80d47f42bd4c3cca401d509229175536ae30f581d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2870
last-modified: Fri, 29 Nov 2019 00:59:19 GMT
server: cloudflare
etag: "b36-59871bd5ed9f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fDLCcmlRW9WEFGUm0pMGF7RXnZ1tIAz6DYpZCa3Jkfhb7H1I%2FviPZ8FtpPuvS75lS2CwKVnH%2B17PLokiDpRlCOeL%2FIXWZ2iLp66ZZVgvvVuxiV6UDvAzSL1yb0veg6XVRByPvhNSHyY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968be9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 livostin.gif
img.medicinestars.com/img/news/517/ 13 KB
13 KB 1930ms
1928ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/517/livostin.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a9ccceb815b16c581d0bc8ef90299697ba872e683068c5a5a5d3c6f41c0ae35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13022
last-modified: Fri, 29 Nov 2019 01:00:21 GMT
server: cloudflare
etag: "32de-59871c117fa0d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MhwpUPXQmLZbkCoC3EVtr7SVfDGmoDZWNUuEDYktr3fRMDRF41ELAineJSvFnIpo%2FejZUHW8PjpfiqKlgpKKvM8zWMWescy%2FIBnmQjPPl2ncKc6iRPi7CWaI5WkkaFyF%2B%2FWl8SG66r8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c09bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 lupron-pediatric.gif
img.medicinestars.com/img/news/993/ 10 KB
11 KB 2899ms
2897ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/993/lupron-pediatric.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97c7c360ba4f859e7297d099ee21bbbe93c3763acaedc5ce3f0ded33387bc603

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10445
last-modified: Fri, 29 Nov 2019 01:04:37 GMT
server: cloudflare
etag: "28cd-59871d050d492"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lcM0OVawz%2F09CM9PMkXcpNIzX6efIbMrE1NJjcu%2BcsF12L%2FZZBICl%2Fmuj4PPSOjFarp%2FC43yOHkuy6RRhsHy4z7J9eaXmqNYlfzuO5pzl7MUXPzB7DuPmkrjQz%2BZ54HPHCaHZLIhuU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c29bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 lactated-ringers.gif
img.medicinestars.com/img/news/233/ 16 KB
16 KB 2935ms
2933ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/233/lactated-ringers.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a1b3fe5049dee2a88ef1f12b1b750fa3d07d1d93dc13837596f4f6ddae629ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16035
last-modified: Fri, 29 Nov 2019 00:58:03 GMT
server: cloudflare
etag: "3ea3-59871b8d615ad"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KBpKUDXUimONemcqMtLN3cTy%2B1TbANgkvmJvYbVO%2Fz7e9QsxLhkek2EBlZKOg3g9LPPxvrhGBUlk%2BMYz5L6TV8jXMcgdAmJKDemXdg6IbQLqZlrBvh4P7pi7yy%2FPYh1hP9dvHKBlV5o%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c39bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 lidamantle.gif
img.medicinestars.com/img/news/876/ 3 KB
3 KB 1919ms
1917ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/876/lidamantle.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83e26def7b9139e9a3e7fb415cd848036149995ee5484642832c423bef356888

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2709
last-modified: Fri, 29 Nov 2019 01:03:27 GMT
server: cloudflare
etag: "a95-59871cc303fee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4YFvbiVZ%2Bsz%2BdL4xulRQQdakyDOxUrqNIwm8%2BX89VMT8qie%2B6DR41XNuD1cVxAefxVPgAG%2Fcy1hbmiXFCkkVTHzVsUbDMc8ZnT9Stf3KZPUhl8pUYqebVsjEwfd%2F3P5fkoT6PbZU9Co%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c49bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 levoleucovorin-calcium.gif
img.medicinestars.com/img/news/917/ 14 KB
15 KB 1909ms
1908ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/917/levoleucovorin-calcium.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

161815039c05fea3169c02a1ccff6306271a827531a5943ac409497a3e1da91b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14560
last-modified: Fri, 29 Nov 2019 01:03:49 GMT
server: cloudflare
etag: "38e0-59871cd7f16c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XQsVfVDnOJdtGuTo8Ps5lKQGruG2m6kyqHh%2FUN16AA8g09zmd9%2FJVi9yJm736%2BTGFzixIM2tM3JiR%2Bb7LP8s3d7YPvk%2BfAGmq21QxuQ55an5JVciOOMlE00RdSBX86j7W6D7jFsFF%2Fc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c59bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 lignospan-forte.gif
img.medicinestars.com/img/news/527/ 8 KB
9 KB 2657ms
2655ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/527/lignospan-forte.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fe5517229af9123b596007bdb836fb3ac35565df6152e2fec893bbe6a4f168b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8471
last-modified: Fri, 29 Nov 2019 01:00:26 GMT
server: cloudflare
etag: "2117-59871c157e16f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVmGaadGDVcI63D7RgVclm%2F4yyTaMzKRsi%2BjHUk1q29p4F7kJ1GNznw%2F8zaZItshkyKXLZy7FSetgR%2FbIo%2B3K49IH3BZ5x31YoZPiESaOa1JzO0KdMpHXJY62%2Ft4qbhe21Z2E2dn5ws%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968c79bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 lindane-lotion.gif
img.medicinestars.com/img/news/100/ 2 KB
3 KB 2430ms
2428ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/100/lindane-lotion.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87b59424747b380687bebf3a0b3c1cfaad7b9c58c814971676854b3c16d4b7f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1976
last-modified: Fri, 29 Nov 2019 00:56:53 GMT
server: cloudflare
etag: "7b8-59871b4ae5d38"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gE7BGXV8i1Hi%2FwG3pE2G6hk6A7KvI5AjMtacemzuqwbxJp%2FsLpoUxXrr7ATX5LPx9GNWHaofTxzHt6XSg9O2toLkoUlA%2BVuaAUFY1XYAMQAed6%2F91CkHrZMb4tZ4Zl1pu5IilWKpDyc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968ca9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 levothyroxine-sodium.gif
img.medicinestars.com/img/news/612/ 10 KB
10 KB 1920ms
1918ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/612/levothyroxine-sodium.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3cc531719b760e4127911fc008cacc3515c573dec428afe9646de9ac0e6dffa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9848
last-modified: Fri, 29 Nov 2019 01:01:00 GMT
server: cloudflare
etag: "2678-59871c36cf641"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ajj2a6M53b%2FxEcH3BeOYvH6IKhhY3ZM8Wkrasd63cGQOP7Sjo512oFVKoP7r8i7jvov2Te0LeQUfRpQzQUIsbai3IjTYkpxSEuwbVHHh39Kii8HMyOksKVpdJbyjpry1s5rSLcxIni4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968cb9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:26 GMT

GET
H3 200 duranest.gif
img.medicinestars.com/img/news/506/ 2 KB
2 KB 2159ms
2157ms Image
image/gif 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.medicinestars.com/img/news/506/duranest.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68f9b196bc54f71ac4b062031d1f2bd7b89ca6fab661200fb0e587a6369e2859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1665
last-modified: Fri, 29 Nov 2019 01:00:16 GMT
server: cloudflare
etag: "681-59871c0ca188a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I5hY6xAZbX0fZM93K12VQSnKuigjqNO5yarJMCxLPxXxtPjRe6p3i6TTBFfworRz7%2FTqQSE9moBNulOcs3WePLMRwPIIbn%2FUyCXYM3YMdqEuWTyAjr%2F2xwMhJy2LjJJ%2BqvrwToR8kVs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 73e5be3968cd9bb8-FRA
expires: Mon, 21 Aug 2023 19:23:27 GMT

GET
H3 200 jegicon.woff
medicinestars.com/template/css/font/ 7 KB
8 KB 2872ms
2845ms Font
application/font-woff 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medicinestars.com/template/css/font/jegicon.woff

Requested by

Host: medicinestars.com
URL: https://medicinestars.com/template/css/main.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2d3127da85763e024971c6192f78becbdf85db231b3d088c9f8b3777d444ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://medicinestars.com/template/css/main.min.css
Origin: https://bg.medicinestars.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 29 Jan 2021 20:26:41 GMT
server: cloudflare
etag: W/"1be8-5ba0fd26bff67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xGUv%2Fk8u6rJzKQdckJqupy5U41bSOuRxZP2VprKJQO9Et3yC1kIBnvdM26zCrNe9lH%2F0y4fzaeJsAzeGgghYzhgjhW%2Bsc98qUPb9%2Fd3X%2BIKhSxPOdaypYerj5ymUO%2FJeySEzOg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=604800
cf-ray: 73e5be3a3f70926d-FRA
expires: Sun, 28 Aug 2022 19:23:27 GMT

GET
H3 200 fontawesome-webfont.woff2
medicinestars.com/template/css/font/ 65 KB
66 KB 2887ms
2860ms Font
text/plain 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medicinestars.com/template/css/font/fontawesome-webfont.woff2

Requested by

Host: medicinestars.com
URL: https://medicinestars.com/template/css/main.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

670f9f133ae7b82f0b92b0b016879f59d2ebd885294c0d69f732860a9ecf609a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://medicinestars.com/template/css/main.min.css
Origin: https://bg.medicinestars.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 66624
last-modified: Fri, 29 Jan 2021 20:26:40 GMT
server: cloudflare
etag: "10440-5ba0fd2698e66"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Xp58puhd2qyZEw%2BHiDUNtrRKn%2Fw%2FfQygpOrV6c0x1711YjEguFuBzYFNKEwmHJbaKaY24Q0a4iFFRDEmXSZ2VYzHWPd5jZKqieb%2Fo65ILRsPkfcuDfnkID39uQNIwPW8VzInQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 73e5be3a3f72926d-FRA
expires: Sun, 28 Aug 2022 19:23:27 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 83 KB
28 KB 112ms
37ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/29c44d7c-8171-46d6-a484-9d3087559448/plugin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

ef7ba5e1b255053d409880374b1d1e76e52c337275c3171fe0f7f9b663526270

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28488
x-xss-protection: 0
server: sffe
etag: "1310 / 739 of 1000 / last-modified: 1660946721"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 21 Aug 2022 19:23:25 GMT

GET
H2 200 prebid5.14.0.js Show response
get.optad360.io/sf/ 460 KB
461 KB 22ms
22ms Script
application/javascript 2600:9000:206f:ca00:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid5.14.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/29c44d7c-8171-46d6-a484-9d3087559448/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:ca00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7109518959a6958168f639860050324f4f063fd1697f32677cf9d0180ab02453

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 00:35:49 GMT
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
last-modified: Thu, 23 Sep 2021 07:59:54 GMT
server: AmazonS3
age: 12595657
etag: "6dd0a13bde35d2daa452bba998871016"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=360000000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 471445
x-amz-cf-id: 42AXGsoyDOLbEA-6pwUBpJxUWxS1wteViRmRg6EZ9zoE_T_Hv37c5Q==

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052
https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052

43 B
528 B

54ms
53ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 21 Aug 2022 19:23:25 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Aug 2021 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 21 Aug 2022 19:23:25 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//bg.medicinestars.com/;0.06860319034318052
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Fri, 20 Aug 2021 21:00:00 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 205 KB
71 KB 234ms
116ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

4feb8a4baf1ab6d4efee5b984ea48ff22af46b19c3b6c21964607fe61eea837c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
last-modified: Mon, 15 Aug 2022 15:05:51 GMT
etag: "62fa369f-118b8"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 71864
expires: Sun, 21 Aug 2022 20:23:25 GMT

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 56ms
30ms Font
font/woff2 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://bg.medicinestars.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 78602
cdn-proxyver: 1.02
cdn-cachedat: 04/09/2022 08:19:45
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: "af7ae505a9eed503f8b8e6982036873e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: c19672a4ede210d52d5cce92187aba2b
accept-ranges: bytes
cf-ray: 73e5be3a5c5d9b63-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H3 200 px_optr.js Show response
cdn.zx-adnet.com/s2r/ 154 B
443 B 90ms
43ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/s2r/px_optr.js

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/optr21_19091901.js

Protocol

Security

QUIC, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

52a3807964b92463ca8e086eb7217d15885eb26ef43ce9d30ae2d676ea434f94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.278596,VS0,VE2
etag: "5fd56412d9c8a7133b545c8894cd95f881c87598574e8ea8bedbcabaa0fda52c-br"
x-served-by: cache-hhn4064-HHN
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 21 Aug 2022 19:23:25 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 94
x-cache-hits: 1

GET
H3 200 abs.js Show response
cdn.zx-adnet.com/adx/ 220 B
496 B 113ms
66ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/adx/abs.js?0.9171189395402919

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/optr21_19091901.js

Protocol

Security

QUIC, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a2862c9e532e9e51ea7ca8d7c96bb602a74e31396f9c5be127dbea7c5adfc227

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
etag: "5fef2687ef3b38d2357073d43abb64a2f46b34fce9295b7d515ee95b7d79cfdb-br"
x-cache: MISS
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 107
x-served-by: cache-hhn4064-HHN
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.278705,VS0,VE45
date: Sun, 21 Aug 2022 19:23:25 GMT
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600,public
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive
x-cache-hits: 0

GET
H2 200 tic
site2text-2021.web.app/ 0
431 B 289ms
213ms Image
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://site2text-2021.web.app/tic?startqa=1&r=0.2636946616390048

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
x-cache: MISS
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 0
x-served-by: cache-muc13924-MUC
server: Google Frontend
x-timer: S1661109805.318072,VS0,VE178
date: Sun, 21 Aug 2022 19:23:25 GMT
x-robots-tag: noindex
vary: cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type: text/html
x-cloud-trace-context: 3dda1d9e975cc657e11926cb49451bdc
cache-control: private
function-execution-id: jqzzw6wwi2ce
accept-ranges: bytes
x-orig-accept-language: de-DE,de;q=0.9
x-country-code: DE
x-cache-hits: 0

GET
H3 200 invisible.js Show response
bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/cb/ Frame A55A 35 KB
13 KB 33ms
32ms Script
application/javascript 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=73e5be36f83eb398

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22666bed6be5e0b0f8f079f23061768f7d99ddb63acd21cfcb4da9344fc03227

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I2MemBuQIUP%2Fn0iYtgXGBFjdc3eUEtfxATcL6Zbm6grN0CQ%2BShumMA2%2BOlQj53arG1HdpZWIkqMB3w17cicI7JKrfT3c9V%2ForI18ZgtnZVv2WsFsBOmyYcsm%2BaG0dmmthDUWifFBxg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 73e5be3acb229bb8-FRA
vary: Accept-Encoding

GET
H3 200 sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js Show response
cdn.zx-adnet.com/consent/ 341 KB
66 KB 48ms
22ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/consent/cookies_gdpr.js?0.5556525583059113

Protocol

Security

QUIC, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

04149c43558d59b2f0f2cc3f679979b915401ca5c94e833479ca9ea754db0b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.278634,VS0,VE0
etag: "903d4e9708a69e8cc899413e10c8bd8c12ff0e8553c05df46fc83d843518567b-br"
x-served-by: cache-hhn4064-HHN
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=315000
date: Sun, 21 Aug 2022 19:23:25 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 67057
x-cache-hits: 84

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 88ms
36ms XHR
application/json 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20220821

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid5.14.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ea2697dd2d0350ed84ce89be6bc75e8462ad5d56e0d70d53c869df80ab8236a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://bg.medicinestars.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 15746
x-jsd-version: 1.0.1439
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19129-FRA, cache-cdg20752-CDG
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"669-U3xo+2ctiPtvj8ftIPnQBFf1f4E"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JNmyYv%2BCkxW2H8SmLD215c8Huj%2B9sWVXjaj31b%2F2qfr%2FIHxIVk2BVTOU2EajC8VEmuaMMphBw9Xr000AfvbK7vF5niKaV5eoonPKudmoc1gNuYSQdusWfWVCTmGf6EeLIMMIu2Mi8oSB58BYZ3s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 73e5be3b6d855b92-FRA
access-control-expose-headers: *

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
938 B 93ms
35ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid5.14.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1146211
x-amz-request-id: txc6abd54ace594ae2a5b2f-00629f4bc7
x-amz-id-2: txc6abd54ace594ae2a5b2f-00629f4bc7
last-modified: Tue, 10 May 2022 09:57:32 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b8NVHa5Tf36CU7FBmHaTGEt9LzLIaGQt2uivMXISpmrHJ32fjatONrmRJ58bIfm2bHHw3aNXr3L5LpLW0UlbUpEAZjPv7kOIY3nwpJyejYCgSs03VoHofxOw%2FHZsSx8ddjMVu6lUs3spM0g%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1652176652152482
cf-ray: 73e5be3b7c838fee-FRA

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
641 B 107ms
46ms XHR
application/json 104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=420039&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22103e63935a2588%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fbg.medicinestars.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A2%2C%22msi%22%3A2%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%225.14.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2225576ddf244871%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22420039%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22420039%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A750%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22420039%22%2C%22sid%22%3A%22750x100%22%7D%7D%5D%7D%7D%5D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22optad360.com%22%2C%22sid%22%3A%224863746%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid5.14.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63f2151fc1362c2212be0a03a85af46e6201301d11eb95c36ae92a0d7fba612b

Request headers

Referer: https://bg.medicinestars.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7tx8Krhba%2Bno4tYkRl4Uao9rqelseRUpAyWBb54A8dDEHc8kQjB8H%2FlnTLUAkVvU0mP9R%2FFfILlV10sy4c4Koxq5tehX%2BRfdCppPgF4sRrxVe5ROfoh8ZFPSduaRA%2FZl1Evs4sJO"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://bg.medicinestars.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 73e5be3b8c799220-FRA
expires: 0

GET
H3 200 pubads_impl_2022081501.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
131 KB 63ms
20ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

6fb2352555371675225ce7b1e1832ac4b1ad8e83dc396d10b70a42dac24addc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 15:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133600
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:36:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 21 Aug 2023 15:33:50 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 82 B
103 B 102ms
57ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=bg.medicinestars.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

a8aafd367af889a8cb97afe6da730dd9afc2356160ce4e7596137f88bced3869

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78
x-xss-protection: 0
expires: Sun, 21 Aug 2022 19:23:25 GMT

GET
H3 200 ui-gdpr-en.feda0fd8c5f2191f5c4b299585520859048f3705.js Show response
cdn.zx-adnet.com/consent/ 230 KB
37 KB 163ms
163ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/consent/ui-gdpr-en.feda0fd8c5f2191f5c4b299585520859048f3705.js

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/consent/sdk.feda0fd8c5f2191f5c4b299585520859048f3705.js

Protocol

Security

QUIC, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ff4b703a37dc11dbca28199ebaa29bfd85fb3793138fdc9bb2b952954d098b68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 27 Apr 2022 20:26:02 GMT
x-timer: S1661109805.434858,VS0,VE142
etag: "dad5947af947c84745a29032a526f3e68afd9ce38af7f41ee281defb94b29c84-br"
x-served-by: cache-hhn4064-HHN
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=315000
date: Sun, 21 Aug 2022 19:23:25 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 37832
x-cache-hits: 0

GET
H2 200 pngpx Show response
faq.worldtourismgroup.com/s2r/ 84 B
629 B 587ms
471ms Script
text/html 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://faq.worldtourismgroup.com/s2r/pngpx

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/s2r/px_optr.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

4d43451d46fa78ceb30ee60f7ce17dd71597ee539629c4f574098171cf3a5aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: gzip
etag: W/"54-rYf1px0jk6tIhIg/Q6a509a6P6A"
x-cache: MISS
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-served-by: cache-hhn4028-HHN
server: Google Frontend
x-timer: S1661109806.560641,VS0,VE452
date: Sun, 21 Aug 2022 19:23:26 GMT
x-robots-tag: noindex
vary: cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type: text/html; charset=utf-8
x-cloud-trace-context: 05c129555f6036c9a2d640ec8207f894
cache-control: no-cache, no-store, must-revalidate
function-execution-id: ebs9901u2w8s
accept-ranges: bytes
x-orig-accept-language: de-DE,de;q=0.9
x-country-code: DE
x-cache-hits: 0

GET
H3 200 checkabuse Show response
cdn.zx-adnet.com/ 56 B
472 B 174ms
173ms Script
text/html 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/checkabuse?surl=https%3A%2F%2Fbg.medicinestars.com%2F

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/abs.js?0.9171189395402919

Protocol

Security

QUIC, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

8601386271d3ba06c1135a092613135c5da90b3732a8196e4761faf4b1afdc69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: gzip
etag: W/"38-qno2VtKrKGrEkeWyGeNb55UMVvo"
x-cache: MISS
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 65
x-served-by: cache-hhn4064-HHN
server: Google Frontend
x-timer: S1661109805.460009,VS0,VE153
date: Sun, 21 Aug 2022 19:23:25 GMT
vary: cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type: text/html; charset=utf-8
x-cloud-trace-context: eeaba436a40550c77362ad885e8b87ba
cache-control: max-age=3600,public
function-execution-id: ks0dtpurrk5q
accept-ranges: bytes
x-orig-accept-language: de-DE,de;q=0.9
x-country-code: DE
x-cache-hits: 0

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 75ms
34ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 114969
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx6e27c385ea21410c8a514-0062f5fbc6
x-amz-id-2: tx6e27c385ea21410c8a514-0062f5fbc6
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UeKFjFzsMVAlUECXtctz6VtBwHELvMETzAl1CcAoaIhcqU0zxJc9GRzk4AXHQyszvsA3Dic9JvUSUrKHMFYtIfvZH6dCIJk%2BCujN3ab6H0pAREory69E6Azt34VRRXnVH7cxA%2FsOGI8x1ypG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 73e5be3c68f59b8e-FRA
access-control-allow-headers: Authorization

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9737.MuJdpzi_pBaj4Ny3pDDtcuXbValAJDqzUfS2aT0HMRAw9A_7BkXPXr0k1gVipxFZ.rmFKL6lqGg-gdWnHU9EnrA2t1vY%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9737.m_b7fthm6KwrnzHmlwUDIOATP9VJ82v4Ir6mKrqJS3M-zLIAlUN8SduFZV_pHs0ZUyokLrgDhTRqlzSLITq01Q%2C%2C.7LWfBk6yOZMTaVTK5nTDYrVDyhw%2C

75 B
75 B

61ms
60ms

Image
text/html

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9737.m_b7fthm6KwrnzHmlwUDIOATP9VJ82v4Ir6mKrqJS3M-zLIAlUN8SduFZV_pHs0ZUyokLrgDhTRqlzSLITq01Q%2C%2C.7LWfBk6yOZMTaVTK5nTDYrVDyhw%2C

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9737.m_b7fthm6KwrnzHmlwUDIOATP9VJ82v4Ir6mKrqJS3M-zLIAlUN8SduFZV_pHs0ZUyokLrgDhTRqlzSLITq01Q%2C%2C.7LWfBk6yOZMTaVTK5nTDYrVDyhw%2C
date: Sun, 21 Aug 2022 19:23:25 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
112 B 62ms
62ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
last-modified: Mon, 15 Aug 2022 15:05:51 GMT
etag: "62fa369f-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 21 Aug 2022 20:23:25 GMT

GET
H3 200 pica.js
bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame A55A 23 KB
8 KB 31ms
31ms Other
application/javascript 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

789defe4f65b1e6671c84b3c388524eec2bff13fc04ae4d0430700ff28516d82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NuYSwJplxN7LJJqcpBzV8ADPfoXQWArGPXUzR7Bfh1ISr%2BRIU87ude%2B2py1AKUWl08tk85lnpI42rFnvjTWaGHcuA58XEJ5viNZ1PEKJG2GiGWJ1isoNqay1gcQ17URjqdoKKuQ3ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 73e5be3cce9d9bb8-FRA
vary: Accept-Encoding

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 76ms
29ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=bg.medicinestars.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 80ms
31ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=bg.medicinestars.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Aug 2022 19:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 112 KB
41 KB 718ms
717ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3452060142286365&correlator=4482244034466132&eid=44764002&output=ldjh&gdfp_req=1&vrg=2022081501&ptt=17&impl=fif&gdpr_consent=CPeGT3JPeGT3JAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA&gdpr=1&addtl_consent=1~7.12.35.62.66.70.89.93.108.122.144.149.153.162.167.184.196.221.241.253.259.272.311.317.323.326.338.348.350.415.440.448.449.482.486.491.494.495.540.571.574.585.587.588.590.725.733.780.817.839.864.867.932.938.981.986.1031.1033.1051.1092.1097.1126.1127.1170.1171.1186.1201.1204.1205.1211.1215.1230.1232.1236.1248.1276.1290.1301.1313.1344.1364.1365.1415.1419.1428.1449.1451.1509.1558.1564.1570.1577.1591.1651.1669.1712.1716.1720.1721.1725.1733.1753.1765.1799.1810.1834.1842.1870.1878.1889.1896.1911.1922.1929.2012.2072.2078.2079.2109.2177.2202.2253.2290.2299.2316.2357.2373.2526.2531.2571.2572.2575.2628.2663.2677.2776.2778.2779.2985.3033.3052.3154&iu_parts=121764058%3A22613287251%2Cwomans-magazine%2Cwomans-magazine_SF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C750x100%7C970x90&ifi=1&adks=411226297&sfv=1-0-38&fsapi=false&sc=1&cookie_enabled=1&abxe=1&dt=1661109805758&lmt=1661109805&dlt=1661109804697&idt=795&adxs=436&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fbg.medicinestars.com%2F&frm=20&vis=1&psz=0x-1&msz=728x-1&fws=640&ohw=0&ga_vid=496297458.1661109806&ga_sid=1661109806&ga_hid=1264621484&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

70b969428494c69129e6eea4b977eb4eca1de2d00b945688f6b7b2ecb16b58a0

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPuUo5_U2PkCFcNE0wodLEANcg&gqi=&layout=/sadbundle/%24csp%253Der3%24/863300823173379816/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPuUo5_U2PkCFcNE0wodLEANcg&gqi=&layout=/sadbundle/%24csp%253Der3%24/863300823173379816/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41899
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Sun, 21 Aug 2022 19:23:26 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://bg.medicinestars.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 90A8 6 KB
4 KB 134ms
28ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bg.medicinestars.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:23:25 GMT
expires: Mon, 21 Aug 2023 19:23:25 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

1 Show response
mc.yandex.com/watch/61431538/
Redirect Chain

https://mc.yandex.com/watch/61431538?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Autf...
https://mc.yandex.com/watch/61431538/1?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Au...

357 B
545 B

59ms
59ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/61431538/1?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A870%3Acn%3A1%3Adp%3A0%3Als%3A300202268802%3Ahid%3A676630161%3Az%3A0%3Ai%3A20220821192325%3Aet%3A1661109805%3Ac%3A1%3Arn%3A1067787064%3Arqn%3A1%3Au%3A16611098051023180886%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1661109804472%3Ads%3A0%2C57%2C71%2C1%2C93%2C0%2C%2C527%2C15%2C%2C%2C%2C750%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1661109806%3At%3A%D0%A1%D1%8A%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%B8%D1%82%D0%B5%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%2C%20%D0%9C%D0%B5%D0%B4%D0%B8%D1%86%D0%B8%D0%BD%D1%81%D0%BA%D0%B8%20%D0%98%D0%B7%D1%81%D0%BB%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%81%D0%BA%D0%B8%20%D0%A1%D1%82%D0%B0%D1%82%D0%B8%D0%B8%2C%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%202022%2C%20%D0%90%D0%B2%D0%B3%D1%83%D1%81%D1%82&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

ac83398de44cbfecbfd9f806f2aaff0055951c1fbb313eb212d30f0242b2930d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 21-Aug-2022 19:23:26 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://bg.medicinestars.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 357
x-xss-protection: 1; mode=block
expires: Sun, 21-Aug-2022 19:23:26 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:25 GMT
last-modified: Sun, 21-Aug-2022 19:23:25 GMT
location: /watch/61431538/1?wmode=7&page-url=https%3A%2F%2Fbg.medicinestars.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Anlzej4hetqp77kpsc2e48%3Afp%3A413%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A870%3Acn%3A1%3Adp%3A0%3Als%3A300202268802%3Ahid%3A676630161%3Az%3A0%3Ai%3A20220821192325%3Aet%3A1661109805%3Ac%3A1%3Arn%3A1067787064%3Arqn%3A1%3Au%3A16611098051023180886%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1661109804472%3Ads%3A0%2C57%2C71%2C1%2C93%2C0%2C%2C527%2C15%2C%2C%2C%2C750%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1661109806%3At%3A%D0%A1%D1%8A%D0%B2%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D0%B8%D1%82%D0%B5%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%2C%20%D0%9C%D0%B5%D0%B4%D0%B8%D1%86%D0%B8%D0%BD%D1%81%D0%BA%D0%B8%20%D0%98%D0%B7%D1%81%D0%BB%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%81%D0%BA%D0%B8%20%D0%A1%D1%82%D0%B0%D1%82%D0%B8%D0%B8%2C%20%D0%9C%D0%B5%D1%82%D0%BE%D0%B4%D0%B8%20%D0%9D%D0%B0%20%D0%9B%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%202022%2C%20%D0%90%D0%B2%D0%B3%D1%83%D1%81%D1%82&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29
strict-transport-security: max-age=31536000
access-control-allow-origin: https://bg.medicinestars.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 21-Aug-2022 19:23:25 GMT

POST
H3 200 73e5be36f83eb398 Show response
bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame A55A 2 B
760 B 53ms
52ms XHR
text/plain 104.21.38.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/cv/result/73e5be36f83eb398

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=73e5be36f83eb398

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.38.78 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qDY3mpLgfG0I4fS9hfeoQVEOQxdFkAbUspOP7kw4tOk%2BBo%2FUpzXRZd29RqYo%2F5yKF2uI24MJqhi0MPOxPBX7XgaadfDXLmDGyg%2BG8wLPxAek1TmuR5%2BX86336EQJQVMDZ2GSj9QlWw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 73e5be3f7bce9bb8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 search
www.google.com/ 0
0 182ms
132ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/search?q=site%3Ahttps%3A%2F%2Ffive-question.com%2Fen%2FQ%2526A%2Fpage%3D7c6fda00db5ad815da31c7c45ec558f1
Requested by: Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 container.html Show response
44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B727 6 KB
3 KB 73ms
28ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bg.medicinestars.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:23:26 GMT
expires: Mon, 21 Aug 2023 19:23:26 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/ Frame FBD8 15 KB
5 KB 88ms
24ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Requested by

Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed8b1dd84b3d8427bacca74cf55cee3515615326b1c6b1351864dd2b78da3ff5

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 402962
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3876
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 17 Aug 2022 03:27:24 GMT
expires: Thu, 17 Aug 2023 03:27:24 GMT
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B727 0
0 65ms
65ms Fetch
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=ChrT7LYYCY7vKMsOJzQasgLWQB4mntcprz7_3oZQQ2abbv_oxEAEgqoDDImCVgoCAlAegAbKKwaoByAEJqQK7UtFPcNKpPuACAKgDAcgDSKoE9wFP0KgjGxNyX8SvlhbBLbfAZoULc72rJKvDRB0pNrMlu22gink0q0CALZOS3QJtc7Tf4s0CEOHgzWCl6p4bxF7aayJmiRuDfCyin5I_R92-XDo4RNBe_Z5h6p8Bjp1bKTSyeF4d1IKHCUhITpA15I6qaHk1U1cRpvdZMsauHYzYwS1VDeVuYcaFLJBT_XchRsA4BRk2eBRAwI43A2X5r8GYrD9Mw1Berfe4bND94LO4W5cXgo_7Y_i36dXXbg-ZIv5I9uNGiTvObDsJyxpiuIWxP9PYketLkcXmED0a1T7nqUCAL7Q9sLa0smFGq05kLpM-JiUEmSuxwAT_t9qZhQTgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHtvW-1QKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCWiwvSCBIIgOGAEBABGB0yAqoCOgOAwAPyCBthZHgtc3Vic3luLTM2NDEyMDMxODg1NjgyODiACgPICwHYEwrQFQGYFgGAFwGyFx4KHAgAEhRwdWItNTUxMjM5MDcwNTEzNzUwNxiS7yE&sigh=XkldD5PkqM0&uach_m=[UACH]&template_id=419
Requested by: Host: bg.medicinestars.com
URL: https://bg.medicinestars.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/ Frame B727 23 KB
10 KB 83ms
22ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/abg_lite_fy2021.js

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:19:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 225
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9668
x-xss-protection: 0
server: cafe
etag: 3250940068065303693
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 04 Sep 2022 19:19:41 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame FBD8 9 KB
3 KB 65ms
21ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 09:41:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34908
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 22 Aug 2022 09:41:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame FBD8 26 KB
10 KB 65ms
22ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 16:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11349
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 22 Aug 2022 16:14:17 GMT

GET
H3 200 e6f40d138158e41bbc4290d1d8f9ae48.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/ Frame FBD8 84 KB
22 KB 70ms
27ms Script
application/x-javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/e6f40d138158e41bbc4290d1d8f9ae48.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63b31da7c560861dc044a6b35c1b51b9664daf1008174e88053ca298a429c8ac

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 405265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22268
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
server: sffe
date: Wed, 17 Aug 2022 02:49:01 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 02:49:01 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 92E2 143 B
426 B 78ms
18ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 730
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Sun, 21 Aug 2022 19:11:16 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame B727 3 KB
1 KB 56ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/window_focus_fy2021.js

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 345
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 04 Sep 2022 19:17:41 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B727 140 KB
44 KB 106ms
44ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44050
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660737283953252"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 19:23:26 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame FBD8 2 KB
1 KB 77ms
28ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/e6f40d138158e41bbc4290d1d8f9ae48.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0e53fe7669a287b3f57bb942dcf1a1fc61c969891ddce211874c475996f8a029

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 21 Aug 2022 17:46:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 21 Aug 2022 19:23:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 21 Aug 2022 19:23:26 GMT

GET
H3 200 5d2621bd596ef5c2c83d009be66f5432.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/ Frame FBD8 13 KB
13 KB 21ms
21ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/5d2621bd596ef5c2c83d009be66f5432.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1b041f5710b8d2adc88aa7ee849409cfac64f18cab33a2c4b83de35844a016d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 405265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13530
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
server: sffe
date: Wed, 17 Aug 2022 02:49:01 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 02:49:01 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 92E2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

78ms
36ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:23:26 GMT
expires: Sun, 21 Aug 2022 19:23:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:23:26 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/ Frame B727 17 KB
7 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220817/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
URL: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:20:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 04 Sep 2022 19:20:05 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame FBD8 15 KB
16 KB 71ms
19ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 05:29:41 GMT
x-content-type-options: nosniff
age: 50025
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 21 Aug 2023 05:29:41 GMT

GET
H3 200 391f7a7a4277d1f9d837ec833bbc3a24.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/ Frame FBD8 13 KB
13 KB 20ms
20ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/391f7a7a4277d1f9d837ec833bbc3a24.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ac456c259cc6079c8419221cfa83da523d6ac408e5b805a2168a7795924b4ad

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 405265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13776
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
server: sffe
date: Wed, 17 Aug 2022 02:49:01 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 02:49:01 GMT

GET
DATA 200
OK truncated
/ Frame B727 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf9301d8e148a6d976f58afb38e93a4b6ee2133f474ea0d6879491f4d3348ca4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 oORtDv9EbGDZJqtoCU6ZUa1h2CU5mRmZpTeRJMx0_5U.js Show response
pagead2.googlesyndication.com/bg/ Frame FBD8 36 KB
14 KB 66ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oORtDv9EbGDZJqtoCU6ZUa1h2CU5mRmZpTeRJMx0_5U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0e46d0eff446c60d926ab68094e9951ad61d82539991999a5379124cc74ff95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 16:38:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14118
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 21 Aug 2023 16:38:52 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B727 42 B
64 B 99ms
58ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv-fn-zABeCiFJYyKBVDhZx43giLMWWJHiR-l_lz8ypp5hWaUu-tFvSf-Kk-FaJlZYd4Vo_QK3wFxMBPi5b4qodTrG1PtFf8oNkxBrtWLe5fkVYZLD0wSCI5NimfxP0J7SzIpgAjzNmwoUB2A&sai=AMfl-YTGvx-YFHbuDgLOYuBpMdemr7abqggQLg8_w94g8-aOR46gmgjaop9KsDEB4ZcaPSvkqnXi9TFrMkFh2L1KK9nNThIlmzW10MTm8aHqjQ&sig=Cg0ArKJSzHMa3WoZkMc5EAE&cid=CAQSLgCsnQUxgkzW_s0nuKJ8xOrgTjm1aVjgJ0-3tyPcdVlltXz8z2ELIu0AjIQ4PLA&id=lidar2&mcvt=1002&p=1110,436,1200,1164&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220817&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=411226297&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1661109806519&rpt=394&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 69ms
68ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022081501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

29cbe7497ba2add4b4497ab7021a052770329b077de9d1504b811728c5bd9b64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Aug 2022 19:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10930
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 19:23:28 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame FC00 13 KB
5 KB 21ms
20ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bg.medicinestars.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 429
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:16:19 GMT
expires: Mon, 21 Aug 2023 19:16:19 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5976 783 B
536 B 31ms
30ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c7ccde06184cecfa56481c038b3e884bf6f01735ffdf9a0b6da8c7fdbfbd825d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-b48Fng5x8i6J5sXJ3fQpjg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bg.medicinestars.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-b48Fng5x8i6J5sXJ3fQpjg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 21 Aug 2022 19:23:28 GMT
expires: Sun, 21 Aug 2022 19:23:28 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 BcUHUABoavvpRAX3o-C5BfAq8AHsMXRVb9HgeqDHxZ8.js Show response
pagead2.googlesyndication.com/bg/ Frame FC00 36 KB
14 KB 62ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BcUHUABoavvpRAX3o-C5BfAq8AHsMXRVb9HgeqDHxZ8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05c5075000686afbe94405f7a3e0b905f02af001ec3174556fd1e07aa0c7c59f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 15:42:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 99685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14190
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 08:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 20 Aug 2023 15:42:03 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5976 0
0 85ms
54ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022081501&jk=3452060142286365&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame FC00 0
10 B 20ms
20ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?z7UQQQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:28 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fbg.medicinestars.com%2F&domain=bg.medicinestars.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=P7FZnXxYZW5ZeVo0dW1qa0FNd0txbDJjNkFtaXhIeUVtOWl5M1NWdkcyV21HTER2cE9BWGhWLzRRdXBsQkZzendaK0JiZGJWWkFycUQvNlRxZVlIS1FGNnJQa3BnUXFiVEE1YmNFQmVERTQxN2Y5WHFNN2txK2VaMm8vM3...

355 B
622 B

124ms
43ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=P7FZnXxYZW5ZeVo0dW1qa0FNd0txbDJjNkFtaXhIeUVtOWl5M1NWdkcyV21HTER2cE9BWGhWLzRRdXBsQkZzendaK0JiZGJWWkFycUQvNlRxZVlIS1FGNnJQa3BnUXFiVEE1YmNFQmVERTQxN2Y5WHFNN2txK2VaMm8vM3BPT3YyMWdYSTZsbGltSE11aEdLU20xd0wvOXRiUG0zZXZMa2pPZkNVeEFXYmprQkNpb2pBd25VWmE2N0VNVmlrMEpVWTlDbEFKVDYxYXBPdGNhejR4OGRKNjlyNDJUc0lEcUsvcmFsSllheGIwVHhLdHBuQW9WQm9HVmtGRnQvd1pBZ0ZCeFVafA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

307293cccde888d515bfe33be0f62fe3cde9b8075bf37a8124cfc27c8bae6dbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:28 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3878
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:28 GMT
location: https://mug.criteo.com/sid?cpp=P7FZnXxYZW5ZeVo0dW1qa0FNd0txbDJjNkFtaXhIeUVtOWl5M1NWdkcyV21HTER2cE9BWGhWLzRRdXBsQkZzendaK0JiZGJWWkFycUQvNlRxZVlIS1FGNnJQa3BnUXFiVEE1YmNFQmVERTQxN2Y5WHFNN2txK2VaMm8vM3BPT3YyMWdYSTZsbGltSE11aEdLU20xd0wvOXRiUG0zZXZMa2pPZkNVeEFXYmprQkNpb2pBd25VWmE2N0VNVmlrMEpVWTlDbEFKVDYxYXBPdGNhejR4OGRKNjlyNDJUc0lEcUsvcmFsSllheGIwVHhLdHBuQW9WQm9HVmtGRnQvd1pBZ0ZCeFVafA&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://bg.medicinestars.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1667
content-length: 509
expires: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 176ms
48ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fbg.medicinestars.com%2F&domain=bg.medicinestars.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://bg.medicinestars.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://bg.medicinestars.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sun, 21 Aug 2022 19:23:28 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1342
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame 8AEF 3 KB
2 KB 141ms
29ms Document
text/html 2.21.184.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid5.14.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.184.247 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-184-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://bg.medicinestars.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1387
Content-Type: text/html; charset=UTF-8
Date: Sun, 21 Aug 2022 19:23:28 GMT
ETag: "e20015-b68-5e4a60c97afb7"
Last-Modified: Mon, 25 Jul 2022 19:18:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server: Apache
Vary: Accept-Encoding

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame BA4A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

1 KB
2 KB

130ms
48ms

Document
text/html

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6eff13f2b51222f5dd43f099979b64eb73220e5694f96ac8b1a851cdcaea8e46

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 73e5be511c339bc2-FRA
content-encoding: br
content-type: text/html
date: Sun, 21 Aug 2022 19:23:28 GMT
dropped-udsids: 241|45|230|39|64|10|196|4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uHKfUreoLu1cJOGHQo8A%2F9D6IXmSyu37raH2AvziqIX2Qct2r9V%2F2fSjFE4mliqT1sU8FQjtMImDiaVOmLPsJ%2FoPJfsXmdmXVdoiURAHt43Ko9a5oKupRk4nQAbWFUQ5P7bg"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 73e5be503b9b6993-FRA
content-type: text/html; charset=iso-8859-1
date: Sun, 21 Aug 2022 19:23:28 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VKugOTX2juXAUExGx5seF8U8GqbkGFvvKQGmWDO7lviVhBxI%2BYh9POgWWyGWh74rH3LHSbPAatixbRPvgNupyKU7G6sjEAL%2BbTE4KHGdXcDGfa06p%2BXEsYVCanc6U4%2BJ801wdcVuG9plTg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 187ms
42ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sun, 21 Aug 2022 19:23:28 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 2382
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 57ms
57ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022081501&jk=3452060142286365&bg=!0dKl0pbNAAYUOm8VNDo7ACkAdvg8WpwKczTrXe8QKlu7Mzgijw6O4ylJWoi1Uh0ezSZvBlweYk2jgwIAAABWUgAAAAJoAQeZAvCPTamdHaggA8QcFwscXnQmtrmFBxZRRtfBvsj9Me1xJNw7QuogzMfBmU8v4PgdaA6Wflg06TvB3-QLcIygMvv9yn8P9ilWilRGaGP-EF4pXq2eh4HEqb5CQDF7-84gEQHxUIPIwgjsScHejBpdXfjnoZn5J3JL1wt2NELOlLFpauvkLkFq5Q9HogV1twc9lNX7caxriStC0Bmy2yVuLV8dhPqz8-MVpRSui_5jUp-3hbx5gejIAalwWe8r-vQS8UnbCJmRk6PGZYafUvCNiUfeILMPUdCVHufiVTn8hJD4-m97IqATXdfjr8_0JHTxe82YmAVHa0pO0lTUFTOfoENyIZ4n-ecs7vPQrn3pCQg_tkZx-Q2wbV-hRVwWCHeR8Q-FGFTC1LQpHTqU2JBm8dBdT0NGQNcUfsfYzKXoiBcdUSIOrlzctQA9B0geNYobvmuGvRM7WZ35BjWkloMOU-poGYYRprqFWH9eo7D4HGJR1vLLivUgEinfkqDSLX9K7BjFgDZ0v-a6h1JBIB6aC8UyMvW_lo6KN4u1QSuSc1P7Cv87aRcwv3yN81IW4Yu0oon3hrO6uGo1wWTvhz-rSsI0pMLPzA81ed8t_v6t0rNOZ85s1DBHglf1b4237zOUwH3-fmKBfCDkGmllR_IvYLisebgNxM-FIKP88hRTGbArTc0BdwzGgK24JHGNUwDG4l9_6CT9XKf54uAwM6Nmwv8KoCIPMsCFLMzIq7fpVWxo9fBcFIoSXinhHNONcSPiWQK9k_frY4bDl5OVEdoge0Rt3aSu1aTwJdlPbBlJ9Ym89CrjrOxNvvIlBzIsggYxxcraSL0yXMsmZk8aBQDtolNmvBzzgd6j0ILRYG6GzBiVTVQ-qh-eAwRux6398MGwQwkkaJTEn6tYrgcDhd2U9u6c6vie1G4U3auX8tMLQVlm7yp-kru2sYSvEKdyEvAR0S1hG2Ow3vb4K6UD_nhvjyX1qGSpAxCJWkR2GjyUojttZA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bg.medicinestars.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame BA4A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB&dcc=t

43 B
645 B

109ms
108ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB&dcc=t

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 21 Aug 2022 19:23:29 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: AJH9PQNS4DQH4K6FMQM5
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 21 Aug 2022 19:23:29 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DW7PCRPRWH3K46TM046M
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame BA4A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YwKGMJ8FcvOXZwSCygAiTAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK_x3SmQfBTXAG7j_eO97uo&google_cver=1&gdpr=1

43 B
913 B

40ms
39ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK_x3SmQfBTXAG7j_eO97uo&google_cver=1&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73e5be52bd079bbc-FRA
pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iXSoG0rNcfdBy%2BAYcRJ%2FRDaZVrhvZZiVbqgG4hqYBe1g7Bz55OamhT4gJrQwGawur8XTJcHBH5DmcHiKMjCamtu%2B2rBDN%2B2HJ1%2BjNSty%2FtvxWv1Tn58ppGV3l0cYIvzFOE0iL%2BaHnSsf6A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK_x3SmQfBTXAG7j_eO97uo&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame BA4A 170 B
502 B 93ms
33ms Image
image/png 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YwKGMJ8FcvOXZwSCygAiTAAABKgAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame BA4A 70 B
265 B 159ms
41ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame BA4A 0
191 B 145ms
36ms Image
text/plain 66.155.71.25
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Aug 2022 19:23:28 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame BA4A
Redirect Chain

https://ums.acuityplatform.com/tum?umid=8
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=687651033622

43 B
940 B

72ms
43ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=687651033622
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73e5be524c3c9bbc-FRA
pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SUpCpw1HBdVXEWwGVvRn9KycmPG61miqQks4wLRLmwCxcihsuJuMGVSlu12ys0khytFE8sbVv%2FdXcTkddeMDdhnF6nfoxx7gAfbmsemadQbuxP0EBJqxXtiteSAjZvxYm9p2HIduvKrp7A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

access-control-allow-origin: *
content-length: 0
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=687651033622

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame BA4A
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

43 B
911 B

45ms
44ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73e5be528cbb9bbc-FRA
pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TCTcMQdIEpJYssWxRaYMKtLunxJ4ZwFnpamGkQcscMNrDCdHtr3%2B0rhhPFqI%2Bxs2%2Fkx3PgrBZuclOBm3ncEUoxUn3OmbOkw3qH%2BeXIGcn3HABDcDTDnFURWXuAqm6OyQnL0TSz4xvqkvNg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Sun, 21 Aug 2022 19:23:29 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame BA4A
Redirect Chain

https://ad.turn.com/r/cs?pid=21&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2604101102979081207

43 B
911 B

38ms
37ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2604101102979081207
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 73e5be527c749bbc-FRA
pragma: no-cache
date: Sun, 21 Aug 2022 19:23:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gsoWJ3BeyOKQGn6W8wvenOh4tsGnGP5VE9q1cRNolN0QIE%2BPOvX7V4qRUAwDfRmrEH3HbvM2245DnOs%2FQUbzrWuidiA%2FjNArkHWRfRfUGLj5savQ00R7uxzShJE%2FjaHHSJd33%2FKL0suBvg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2604101102979081207
pragma: no-cache
date: Sun, 21 Aug 2022 19:23:28 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame BA4A 43 B
424 B 96ms
29ms Image
image/gif 2606:4700::6812:d4c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?YwKGMJ8FcvOXZwSCygAiTAAA%261192
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fbg.medicinestars.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d4c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 19:23:28 GMT
cf-cache-status: HIT
age: 128
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
content-length: 43
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
etag: "da1f1d-2b-546dc3a097100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 73e5be51ef8490a0-FRA
expires: Sun, 21 Aug 2022 23:23:28 GMT

GET
H3 200 391f7a7a4277d1f9d837ec833bbc3a24.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/ Frame FBD8 13 KB
13 KB 21ms
20ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/391f7a7a4277d1f9d837ec833bbc3a24.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ac456c259cc6079c8419221cfa83da523d6ac408e5b805a2168a7795924b4ad

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 405268
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13776
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
server: sffe
date: Wed, 17 Aug 2022 02:49:01 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 02:49:01 GMT

GET
H3 200 d34ccf238d4bf4e0765398db2e1d9d0c.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/ Frame FBD8 16 KB
16 KB 21ms
20ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/863300823173379816/media/d34ccf238d4bf4e0765398db2e1d9d0c.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cd271e1a4ae2c2a2276470d9cb8d01671929f60aaa827ae221541c91337be5b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 405265
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16534
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 01:11:45 GMT
server: sffe
date: Wed, 17 Aug 2022 02:49:04 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Aug 2023 02:49:04 GMT

Verdicts & Comments Add Verdict or Comment

129 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bg.medicinestars.com/	1970-01-20 06:08:21	Name: _pbjs_userid_consent_data Value: 6683316680106290
.yadro.ru/	1970-01-20 14:09:25	Name: FTID Value: 1Z0eOj1Bwq8O1Z0eOj002VmO
.medicinestars.com/	1970-01-20 14:10:45	Name: _ym_uid Value: 16611098051023180886
.medicinestars.com/	1970-01-20 14:10:45	Name: _ym_d Value: 1661109805
.yadro.ru/	1970-01-20 14:09:25	Name: VID Value: 2L_8KH0przuO1Z0eOj0028w0
.mc.yandex.com/	1970-01-20 05:25:10	Name: sync_cookie_csrf Value: 1230609880fake
.medicinestars.com/	1970-01-20 05:26:21	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 05:25:10	Name: sync_cookie_csrf Value: 3658003592fake
.medicinestars.com/	1970-01-20 14:10:45	Name: didomi_token Value: eyJ1c2VyX2lkIjoiMTgyYzFkYzItMTJiZS02ODI0LWFhZjEtYzE4ZjFjMDI5OWVhIiwiY3JlYXRlZCI6IjIwMjItMDgtMjFUMTk6MjM6MjUuNjU0WiIsInVwZGF0ZWQiOiIyMDIyLTA4LTIxVDE5OjIzOjI1LjY1NFoiLCJ2ZW5kb3JzIjp7ImVuYWJsZWQiOlsiZ29vZ2xlIl19LCJ2ZW5kb3JzX2xpIjp7ImVuYWJsZWQiOlsiZ29vZ2xlIl19LCJ2ZXJzaW9uIjoyfQ==
.medicinestars.com/	1970-01-20 14:10:45	Name: euconsent-v2 Value: CPeGT3JPeGT3JAHABBENBACgAP_AAH_AAAAAHFNf_X_fb3_j-_59_9t0eY1f9_7_v20zjgeds-8Nyd_X_L8X4mM7vB36pq4KuR4Eu3LBAQdlHOHcTUmw6IkVqTPsbk2Mr7NKJ7PEinMbe2dYGH9_n9XTuZKY79_s___z__-__v__7_f_r-3_3_vp9V---wOJAJMNS-AizEscCSaNKoUQIQriQ6AEAFFCMLRNYQErgp2VwEfoIGACA1ARgRAgxBRiyCAAAAAJKIgJADwQCIAiAQAAgBUgIQAEaAILACQMAgAFANCwAigCECQgyOCo5TAgIkWignkrAEou9jDCEMooAaBAAAAA.f_gAD_gAAAAA
.yandex.com/	1970-01-20 14:10:45	Name: yandexuid Value: 8629567391661109805
.yandex.com/	1970-01-20 14:10:45	Name: yuidss Value: 8629567391661109805
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 70508531661109805
.yandex.com/	1970-01-20 15:01:09	Name: i Value: RsvjNIQ1d/X2zkROL40vktJHl/dknGOoP0gckZjVDQG4aaDcpTJR5Wg1ZCvEJ3x0k25k05RxvGcBqfxUIS9oW2AIX1w=
.yandex.com/	1970-01-20 14:10:45	Name: ymex Value: 1692645805.yrts.1661109805#1692645805.yrtsi.1661109805
.medicinestars.com/	1970-01-20 05:25:11	Name: __cf_bm Value: hxRiT5yLSOUUp9asxatHiTdd16fPWq8TcEqtyDsYR1M-1661109806-0-AcRxAxnqIhJO4SY6Yc+VCcKOmG2LHDbfOafx8+bYzz6tuydWiDdhcqmaHTSZvgAvhA9IVnJ+m8cO8/5JJ6zhE5AItxWzziuoO4Dx8g+zOEsuTy/uUfhKpE8WJsdLEKqlwA==
.medicinestars.com/	1970-01-20 14:46:45	Name: __gads Value: ID=bafb0c01545c428e:T=1661109805:S=ALNI_MZNcK22_qnUHFDbPX-zFX0lUzylsQ
.doubleclick.net/	1970-01-20 14:46:45	Name: IDE Value: AHWqTUmDv7KP0f2Nmjp8-C2_HThTCKlbXd900tLFFRKOhpEVA3Lk3i0gv-dxPhJd8-I
.doubleclick.net/	1970-01-20 05:25:13	Name: DSID Value: NO_DATA
.casalemedia.com/	1970-01-20 14:10:45	Name: CMID Value: YwKGMJ8FcvOXZwSCygAiTAAA
.casalemedia.com/	1970-01-20 07:34:45	Name: CMPS Value: 1146
.casalemedia.com/	1970-01-20 07:34:45	Name: CMPRO Value: 1192
.casalemedia.com/	1970-01-20 05:26:36	Name: CMST Value: YwKGMGMChjAA
.casalemedia.com/	1970-01-20 14:10:45	Name: CMRUM3 Value: 27630286300b40&e6630286302760&2d6302863005a0&0a6302863027600&046302863005a0&c46302863005a0&f16302863005a0&406302863005a0
.acuityplatform.com/	1970-01-20 14:10:45	Name: auid Value: 687651033622
.acuityplatform.com/	1970-01-20 14:10:45	Name: aum Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAOPqNdXNlck1hdGNoaW5nSWTQkWxhc3REcm9wVGltZU1pbGxpcyUBQTA7QnmwmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUEwO0J5sI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.turn.com/	1970-01-20 09:44:21	Name: uid Value: 2604101102979081207
bg.medicinestars.com/	1970-01-20 14:46:45	Name: cto_bundle Value: L19SPV9qJTJCMXJaYXklMkZ3UXZMVU9vZDBVWlI0RHQ4N0hLZ3ByUmdLSnBsVEZoJTJCZVVwSHU0Q1lQWDllSE9WZkYzS2hkclZXVGNhOWgxeVZjWE1tMjlXJTJCVFRyMURrUmhaVCUyQnFDVVRUcmo0cXRtSkpGTzBBcjZxaFM5YUJ3aVVCWWY2RE1GeTI
bg.medicinestars.com/	1970-01-20 14:46:45	Name: cto_bidid Value: 2Dvh-F81OU92ekRlcnVQNnUyaVRBUDVNYnhoWEtNclAxWmtyczRmdjYlMkI0aUZsVU8yM29VJTJCQ0JzcUR3bG9IbG12YWdCJTJGZHc1T2UlMkZCdzhqbzk2OWVEUWVpbW1RJTNEJTNE
.casalemedia.com/	1970-01-20 07:34:45	Name: CMTS Value: 5149

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9737.m_b7fthm6KwrnzHmlwUDIOATP9VJ82v4Ir6mKrqJS3M-zLIAlUN8SduFZV_pHs0ZUyokLrgDhTRqlzSLITq01Q%2C%2C.7LWfBk6yOZMTaVTK5nTDYrVDyhw%2C Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

44a8415558c04d88d614d52a3f31207c.safeframe.googlesyndication.com
ad.turn.com
adservice.google.com
adservice.google.de
bg.medicinestars.com
cdn.indexww.com
cdn.jsdelivr.net
cdn.zx-adnet.com
cm.g.doubleclick.net
code.jquery.com
counter.yadro.ru
dsum-sec.casalemedia.com
faq.worldtourismgroup.com
fonts.googleapis.com
fonts.gstatic.com
get.optad360.io
googleads.g.doubleclick.net
gu.dyntrk.com
gum.criteo.com
htlb.casalemedia.com
img.medicinestars.com
js-sec.indexww.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
mc.yandex.com
mc.yandex.ru
medicinestars.com
mug.criteo.com
pagead2.googlesyndication.com
pixel-sync.sitescout.com
r.casalemedia.com
s.amazon-adsystem.com
script.4dex.io
securepubads.g.doubleclick.net
site2text-2021.web.app
ssum-sec.casalemedia.com
tpc.googlesyndication.com
ums.acuityplatform.com
www.google.com
www.googletagservices.com
104.18.18.126
104.18.19.126
104.21.38.78
135.125.160.160
142.250.185.130
142.250.186.162
15.197.193.217
151.101.65.195
154.59.122.79
172.67.220.23
178.250.0.157
199.36.158.100
2.21.184.247
2001:4de0:ac18::1:a:1a
2001:678:cb4:bbbb::11
2600:9000:206f:ca00:11:a4de:2580:93a1
2606:4700:20::ac43:4bf1
2606:4700::6810:5714
2606:4700::6812:acf
2606:4700::6812:d4c
2620:0:890::100
2a00:1450:4001:808::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:811::2002
2a00:1450:4001:812::2004
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:831::2001
2a02:2638:1::13
2a02:6b8::1:119
52.46.130.91
66.155.71.25
88.212.201.204
04149c43558d59b2f0f2cc3f679979b915401ca5c94e833479ca9ea754db0b89
05c5075000686afbe94405f7a3e0b905f02af001ec3174556fd1e07aa0c7c59f
06a75edfd3dc41cda52912c763150e03229959984e855ef670426dc8f6f410b9
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cd271e1a4ae2c2a2276470d9cb8d01671929f60aaa827ae221541c91337be5b
0d9027289ffa5d9f6c8b4e0782bb31bbff2cef5ee3708ccbcb7a22df9128bb21
0e53fe7669a287b3f57bb942dcf1a1fc61c969891ddce211874c475996f8a029
0ea2697dd2d0350ed84ce89be6bc75e8462ad5d56e0d70d53c869df80ab8236a
161815039c05fea3169c02a1ccff6306271a827531a5943ac409497a3e1da91b
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1ac456c259cc6079c8419221cfa83da523d6ac408e5b805a2168a7795924b4ad
1fe5517229af9123b596007bdb836fb3ac35565df6152e2fec893bbe6a4f168b
22666bed6be5e0b0f8f079f23061768f7d99ddb63acd21cfcb4da9344fc03227
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
29cbe7497ba2add4b4497ab7021a052770329b077de9d1504b811728c5bd9b64
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
307293cccde888d515bfe33be0f62fe3cde9b8075bf37a8124cfc27c8bae6dbe
3665713c8449f0eb6669b4473fdf731b92c0e36bc790b70aed83f992863f4130
3813da7176a62efec0309d6c5082e37fc441bd83892f153b1571ba94972616dd
38e136890d4ebf25d95eec324126f4a623c8d1cef597b97a2411cde6cdaeeaef
3cc531719b760e4127911fc008cacc3515c573dec428afe9646de9ac0e6dffa6
4a1b3fe5049dee2a88ef1f12b1b750fa3d07d1d93dc13837596f4f6ddae629ac
4d43451d46fa78ceb30ee60f7ce17dd71597ee539629c4f574098171cf3a5aed
4feb8a4baf1ab6d4efee5b984ea48ff22af46b19c3b6c21964607fe61eea837c
52a3807964b92463ca8e086eb7217d15885eb26ef43ce9d30ae2d676ea434f94
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
5572bb73e63e040969714fcc2a6519fa71e062fead143959cf7688193c0a6bd0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63b31da7c560861dc044a6b35c1b51b9664daf1008174e88053ca298a429c8ac
63f2151fc1362c2212be0a03a85af46e6201301d11eb95c36ae92a0d7fba612b
64c03414e898ee258c61921bbdd483d1c0f3b4e76949f94c129193f4624cbce4
670f9f133ae7b82f0b92b0b016879f59d2ebd885294c0d69f732860a9ecf609a
6723ea2989d5cf57335b26d5bd0bcc52feffab866915b917c4cdcae672c99a2a
68f9b196bc54f71ac4b062031d1f2bd7b89ca6fab661200fb0e587a6369e2859
6eff13f2b51222f5dd43f099979b64eb73220e5694f96ac8b1a851cdcaea8e46
6fb2352555371675225ce7b1e1832ac4b1ad8e83dc396d10b70a42dac24addc7
70b969428494c69129e6eea4b977eb4eca1de2d00b945688f6b7b2ecb16b58a0
7109518959a6958168f639860050324f4f063fd1697f32677cf9d0180ab02453
741b4c29522df6ef52528107450be650cd3b92fcb52b659e9ff0a49e40e3e730
789defe4f65b1e6671c84b3c388524eec2bff13fc04ae4d0430700ff28516d82
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a9ccceb815b16c581d0bc8ef90299697ba872e683068c5a5a5d3c6f41c0ae35
7ee99e16db8648e2607113b4de84ca9b1eda3336c59513fd7afbbe2eadd488f6
826dd094ec1f2f1eb3b71433722bb3a5f3171153e74bd0b9a754886d10a4acf0
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
83e26def7b9139e9a3e7fb415cd848036149995ee5484642832c423bef356888
8601386271d3ba06c1135a092613135c5da90b3732a8196e4761faf4b1afdc69
87b59424747b380687bebf3a0b3c1cfaad7b9c58c814971676854b3c16d4b7f4
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8d1b30d734ca1985b158a2f966d6cd90b241727d104f94d72062a4a997208405
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
920bf5e0981c083ac0cc65869559295260817baa40cdd79fd293fa7d7acf5456
97c7c360ba4f859e7297d099ee21bbbe93c3763acaedc5ce3f0ded33387bc603
a0e46d0eff446c60d926ab68094e9951ad61d82539991999a5379124cc74ff95
a2862c9e532e9e51ea7ca8d7c96bb602a74e31396f9c5be127dbea7c5adfc227
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a8aafd367af889a8cb97afe6da730dd9afc2356160ce4e7596137f88bced3869
ac83398de44cbfecbfd9f806f2aaff0055951c1fbb313eb212d30f0242b2930d
ae2b3292ce4d22938259dd7e2d411ef3e498276837fbcc0475af40237b608f1f
b00918011c28609f2a10554eb2bb83944f701b40e7a5c3cf959bf19d3c61cbb3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6
ba7478138664dfbadff2af30a268f4200a752a73d07dafb55937af20d1061357
ba7beca0f5402387b359ad40d2af0dda9632f6b81e2aa0c26336324c358c3e10
bda12b021bd92684a9ccabe80d47f42bd4c3cca401d509229175536ae30f581d
be3cec4985947de27bff90e08dba36fda4e4d1013bbc741f521185c0630d527e
bf9301d8e148a6d976f58afb38e93a4b6ee2133f474ea0d6879491f4d3348ca4
c12395451dd35e7f1feb3e75840752f393e690cfe90019b8596e0358c0b9a26d
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c7ccde06184cecfa56481c038b3e884bf6f01735ffdf9a0b6da8c7fdbfbd825d
d5c482d8a44f8456aff84b0afd5dd59ea494e8497dfdb9822dbe649972faf0cc
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
e1b041f5710b8d2adc88aa7ee849409cfac64f18cab33a2c4b83de35844a016d
e2d3127da85763e024971c6192f78becbdf85db231b3d088c9f8b3777d444ede
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
ed8b1dd84b3d8427bacca74cf55cee3515615326b1c6b1351864dd2b78da3ff5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef7ba5e1b255053d409880374b1d1e76e52c337275c3171fe0f7f9b663526270
f30ec3067a19932bdd2bdaa6387046b00b6ee49d55a5129a34f16d5c859c33fc
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
ff4b703a37dc11dbca28199ebaa29bfd85fb3793138fdc9bb2b952954d098b68

bg.medicinestars.com Open in urlscan Pro 172.67.220.23 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

118 Requests

92 %HTTPS

56 %IPv6

28 Domains

40 Subdomains

34 IPs

8 Countries

2191 kBTransfer

5621 kBSize

30 Cookies

33 Outgoing links

Page URL History

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bg.medicinestars.com Open in urlscan Pro
172.67.220.23 Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

92 %
HTTPS

56 %
IPv6

28
Domains

40
Subdomains

34
IPs

8
Countries

2191 kB
Transfer

5621 kB
Size

30
Cookies

118 HTTP transactions
2 data transactions