gursesintour.com Open in urlscan Pro
5.9.195.152 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://gursesintour.com/
Effective URL:
https://gursesintour.com/
Submission: On January 17 via manual (January 17th 2022, 4:50:59 pm UTC) from GB — Scanned from GB

Summary HTTP 203 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 42 IPs in 10 countries across 37 domains to perform 203 HTTP transactions. The main IP is 5.9.195.152, located in Germany and belongs to HETZNER-AS, DE. The main domain is gursesintour.com.
TLS certificate: Issued by R3 on December 14th 2021. Valid for: 3 months.

This is the only time gursesintour.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 67	5.9.195.152 5.9.195.152	24940 (HETZNER-AS) (HETZNER-AS)
3	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	67.207.77.125 67.207.77.125	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	85.192.12.170 85.192.12.170	12695 (DINET-AS) (DINET-AS)
4	85.192.12.173 85.192.12.173	12695 (DINET-AS) (DINET-AS)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1 2	88.212.201.216 88.212.201.216	39134 (UNITEDNET) (UNITEDNET)
1	2606:4700:303... 2606:4700:3031::6815:1c44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	193.106.93.124 193.106.93.124	48614 (ITSOFT-AS) (ITSOFT-AS)
1	13.32.99.33 13.32.99.33	16509 (AMAZON-02) (AMAZON-02)
3	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
6	185.29.132.242 185.29.132.242	30419 (MEDIAMATH...) (MEDIAMATH-INC)
11	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
1 1	146.0.227.110 146.0.227.110	29066 (VELIANET-...) (VELIANET-AS velia.net Internetdienste GmbH)
1	193.200.65.6 193.200.65.6	6681 (GIVEME-CLOUD) (GIVEME-CLOUD)
3 4	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
3 5	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
3 4	185.33.220.100 185.33.220.100	29990 (ASN-APPNEX) (ASN-APPNEX)
5	138.201.84.252 138.201.84.252	24940 (HETZNER-AS) (HETZNER-AS)
2	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS)
18	2a00:1450:400... 2a00:1450:4001:829::2006	15169 (GOOGLE) (GOOGLE)
4	144.76.238.55 144.76.238.55	24940 (HETZNER-AS) (HETZNER-AS)
3	159.69.70.9 159.69.70.9	24940 (HETZNER-AS) (HETZNER-AS)
2 2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
1 2	2a01:4f8:d0a:... 2a01:4f8:d0a:2321::2	24940 (HETZNER-AS) (HETZNER-AS)
1	167.233.14.134 167.233.14.134	24940 (HETZNER-AS) (HETZNER-AS)
1 2	172.217.18.102 172.217.18.102	15169 (GOOGLE) (GOOGLE)
1	54.76.176.197 54.76.176.197	16509 (AMAZON-02) (AMAZON-02)
1 3	104.111.239.217 104.111.239.217	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	185.85.15.23 185.85.15.23	200107 (KL-EXT) (KL-EXT)
1	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
203	42

67 5.9.195.152 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: undefined.agho.st

gursesintour.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.207.77.125 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

admessage.support	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.192.12.170 (Russian Federation)

ASN12695 (DINET-AS, RU)

k0r2eokjm6.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 85.192.12.173 (Russian Federation)

ASN12695 (DINET-AS, RU)

pxksnymto.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmpprof.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dprof.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.216 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host216.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6815:1c44 (United States)

ASN13335 (CLOUDFLARENET, US)

rp-rep.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.106.93.124 (Russian Federation)

ASN48614 (ITSOFT-AS, RU)

prodmp.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-33.fra60.r.cloudfront.net

openfpcdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.29.132.242 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.0.227.110 (Ascension Island) 1 redirects

ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE)

inv-nets.admixer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.200.65.6 (Amsterdam, Netherlands)

ASN6681 (GIVEME-CLOUD, PL)
PTR: adforce.team

m.trafmag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.162 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.18.234.21 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.220.100 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 138.201.84.252 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.252.84.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:829::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 144.76.238.55 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.55.238.76.144.clients.your-server.de

hal900021.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 159.69.70.9 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.9.70.69.159.clients.your-server.de

hal900017.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France) 2 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.250.30 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a01:4f8:d0a:2321::2 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

cdn.retailads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.233.14.134 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: lb-2.futalis.de

futalis.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.102 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f102.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.176.197 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.239.217 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.85.15.23 (Switzerland)

ASN200107 (KL-EXT, RU)

media.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	gursesintour.com 1 redirects gursesintour.com	879 KB
26	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 100 tpc.googlesyndication.com — Cisco Umbrella Rank: 124	282 KB
19	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 46 stats.g.doubleclick.net — Cisco Umbrella Rank: 96 cm.g.doubleclick.net — Cisco Umbrella Rank: 197 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 274 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 91857	67 KB
18	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 255	712 KB
15	gstatic.com fonts.gstatic.com	289 KB
12	redintelligence.net hal9000.redintelligence.net — Cisco Umbrella Rank: 32669 hal900021.redintelligence.net — Cisco Umbrella Rank: 243127 hal900017.redintelligence.net — Cisco Umbrella Rank: 230697	43 KB
8	mathtag.com tags.mathtag.com — Cisco Umbrella Rank: 3608 pixel.mathtag.com — Cisco Umbrella Rank: 1240	6 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 590	4 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 241	4 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47 ajax.googleapis.com — Cisco Umbrella Rank: 293	35 KB
3	awin1.com 1 redirects www.awin1.com — Cisco Umbrella Rank: 14385	2 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 165	112 KB
3	google.com adservice.google.com — Cisco Umbrella Rank: 80 www.google.com — Cisco Umbrella Rank: 13	2 KB
2	retailads.net 1 redirects cdn.retailads.net — Cisco Umbrella Rank: 175237	5 KB
2	medialead.de 2 redirects pv.medialead.de — Cisco Umbrella Rank: 48812	2 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	313 B
2	dmpprof.com dmpprof.com — Cisco Umbrella Rank: 21379	997 B
2	prodmp.ru prodmp.ru — Cisco Umbrella Rank: 46144	359 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	113 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	20 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 8294	1 KB
1	kaspersky.com media.kaspersky.com — Cisco Umbrella Rank: 137138	80 KB
1	ad-server.eu ad-server.eu — Cisco Umbrella Rank: 72240	312 B
1	futalis.de futalis.de — Cisco Umbrella Rank: 317714	409 B
1	media01.eu pb.media01.eu — Cisco Umbrella Rank: 46801	606 B
1	dprof.site dprof.site — Cisco Umbrella Rank: 131327	541 B
1	trafmag.com m.trafmag.com — Cisco Umbrella Rank: 137369	351 B
1	admixer.net 1 redirects inv-nets.admixer.net — Cisco Umbrella Rank: 2627	497 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 8028	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 777	649 B
1	openfpcdn.io openfpcdn.io — Cisco Umbrella Rank: 41203	422 B
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1713	4 KB
1	rp-rep.net rp-rep.net — Cisco Umbrella Rank: 875052	597 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	40 KB
1	pxksnymto.ru pxksnymto.ru — Cisco Umbrella Rank: 92382	48 KB
1	k0r2eokjm6.ru k0r2eokjm6.ru	42 KB
1	admessage.support admessage.support	16 KB
203	37

	Domain	Requested by
67	gursesintour.com	1 redirects gursesintour.com
18	s0.2mdn.net	gursesintour.com s0.2mdn.net
15	fonts.gstatic.com	fonts.googleapis.com
15	pagead2.googlesyndication.com	gursesintour.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net www.googletagservices.com
11	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net pagead2.googlesyndication.com
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
6	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
5	hal9000.redintelligence.net	gursesintour.com hal900021.redintelligence.net
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
4	hal900021.redintelligence.net	hal9000.redintelligence.net hal900021.redintelligence.net
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
3	www.awin1.com	1 redirects googleads.g.doubleclick.net
3	hal900017.redintelligence.net	hal9000.redintelligence.net hal900017.redintelligence.net
3	www.googletagservices.com	googleads.g.doubleclick.net
3	fonts.googleapis.com	gursesintour.com s0.2mdn.net hal900021.redintelligence.net
2	5994599.fls.doubleclick.net	1 redirects gursesintour.com
2	cdn.retailads.net	1 redirects futalis.de
2	pv.medialead.de	2 redirects
2	googleads4.g.doubleclick.net	gursesintour.com
2	pixel.mathtag.com	tags.mathtag.com
2	www.facebook.com	gursesintour.com
2	dmpprof.com	pxksnymto.ru
2	adservice.google.com	pagead2.googlesyndication.com 5994599.fls.doubleclick.net
2	prodmp.ru	pxksnymto.ru
2	connect.facebook.net	gursesintour.com connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	counter.yadro.ru	1 redirects gursesintour.com
1	www.google.com	tpc.googlesyndication.com
1	media.kaspersky.com	hal900017.redintelligence.net
1	ajax.googleapis.com	hal900017.redintelligence.net
1	ad-server.eu	googleads.g.doubleclick.net
1	futalis.de	hal900021.redintelligence.net
1	pb.media01.eu	hal900021.redintelligence.net
1	dprof.site	pxksnymto.ru
1	m.trafmag.com	gursesintour.com
1	inv-nets.admixer.net	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	openfpcdn.io	pxksnymto.ru
1	secure.gravatar.com	gursesintour.com
1	rp-rep.net	admessage.support
1	www.googletagmanager.com	gursesintour.com
1	pxksnymto.ru	k0r2eokjm6.ru
1	k0r2eokjm6.ru	gursesintour.com
1	admessage.support	gursesintour.com
203	47

This site contains links to these domains. Also see Links.

Domain
www.liveinternet.ru

Subject Issuer	Validity	Valid
gursesintour.com R3	`2021-12-14` - `2022-03-14`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
admessage.support R3	`2021-07-07` - `2021-10-05`	3 months	crt.sh
kdunhltakb.ru R3	`2021-11-27` - `2022-02-25`	3 months	crt.sh
pwrlkyotm.com R3	`2022-01-01` - `2022-04-01`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
rp-rep.net Cloudflare Inc ECC CA-3	`2021-06-04` - `2022-06-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-10-27` - `2022-01-25`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
prodmp.ru R3	`2021-12-14` - `2022-03-14`	3 months	crt.sh
openfpcdn.io Amazon	`2021-11-11` - `2022-12-10`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
dmpprof.com R3	`2021-11-22` - `2022-02-20`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
redintelligence.net R3	`2021-12-21` - `2022-03-21`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-05-27` - `2022-05-27`	a year	crt.sh
*.futalis.de R3	`2021-12-23` - `2022-03-23`	3 months	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
cdn.retailads.net Encryption Everywhere DV TLS CA - G1	`2021-07-17` - `2022-07-17`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://gursesintour.com/
Frame ID: 2F61420AFD69A4EFD05097B0C85C030A
Requests: 111 HTTP requests in this frame

Frame: data://truncated
Frame ID: 2B85A841A573CB8EB43A4117C69B3537
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html
Frame ID: 336A21E039A8EAD50EC2B8EE09F87313
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0170365603936560&output=html&adk=1812271804&adf=3025194257&lmt=1642438252&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fgursesintour.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252685&bpp=3&bdt=1315&idt=285&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=301
Frame ID: 35C81D340F9530CB0D4EA963C027623B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308
Frame ID: A6C3BF95B8B8DC4911D81EFA173FDCE3
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=8889884284&adk=4224436493&adf=319921765&pi=t.ma~as.8889884284&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252690&bpp=1&bdt=1320&idt=325&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1077&ady=1028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4MC7K2WOCD&p=https%3A//gursesintour.com&dtd=328
Frame ID: B6C9C15307267566CAB36B433287B2C9
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1977825725&adk=3441218270&adf=1271596161&pi=t.ma~as.1977825725&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=333&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=650&ady=1486&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=Fe6YC4ISFC&p=https%3A//gursesintour.com&dtd=335
Frame ID: 63FE7DE16C13627DBB58CEBE3DD37A66
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1890976066&adk=2959816976&adf=1772616195&pi=t.ma~as.1890976066&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=350&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=711&ady=2538&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=TTQhbWVLc8&p=https%3A//gursesintour.com&dtd=353
Frame ID: 8790ABEB0488724C53980224C95ADE50
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKTpogIQudCjAhjt2IO-ATAB&v=APEucNUdiFX07oAtME4WWz4-ZUffz3bc5_bHcGqChYrbMkH65gxVmxmJRt3wB5snt7vWXQL2spvRBY_YYIZmU_-x14HkjtbRt2gs3zYnEeIEQWBpJYdBBNH0mQmal7p7gkqSOGS8jFgK1tdI9Yu5f1J01uRl4VjEtLFZy5Ejo9MczzqqmTK-jXE
Frame ID: A9F8670CAED0CA1562CB11F5B88BF991
Requests: 5 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 6AA6E71665B0CD891FBAF36C76E85406
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FA9C9CF8E8356F047541E68AA4A8213F
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
Frame ID: C9B0A4B4B7FF4E99E39BD731519FC207
Requests: 20 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=23553600214937700951389011842021&actionid=731824&produktid=businessgiro&dt_url=
Frame ID: D56D9F095F5AD744B8F4D5B1603B4C21
Requests: 1 HTTP requests in this frame

Frame: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716
Frame ID: 4AE9D4D8BF369BDB286FA27231C77F91
Requests: 2 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804
Frame ID: 5DCDB4D31A592AC2552A1401F63A8104
Requests: 2 HTTP requests in this frame

Frame: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Frame ID: E1D601BBFFFD7EF0A8F40A165977F009
Requests: 7 HTTP requests in this frame

Frame: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b
Frame ID: C69503B9E28F02F4F4CCBC10E40664E7
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js
Frame ID: 30B70BC5A7B3FDDB5571CD20239D0F99
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 19B7561F54EBEB9204C8AD9643D321D5
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A3732FFBBBE06FD34ECAE1660D43A6CD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Главная - "gursesintour.com" - познавательный туристический портал

Page URL History Show full URLs

http://gursesintour.com/ HTTP 301
https://gursesintour.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

203
Requests

95 %
HTTPS

42 %
IPv6

37
Domains

47
Subdomains

42
IPs

10
Countries

2804 kB
Transfer

8048 kB
Size

27
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.liveinternet.ru/click

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gursesintour.com/ HTTP 301
https://gursesintour.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85

https://counter.yadro.ru/hit?t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348 HTTP 302
https://counter.yadro.ru/hit?q;t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348

Request Chain 117

https://inv-nets.admixer.net/adxcm.aspx?ssp=7E53F656-3653-491C-995F-4CD355497FC2&id=e78683af-8981-4383-8b0d-599b60d624f1 HTTP 302
https://m.trafmag.com/images/1px-matching-go2net.gif?id=f7563efcfb614c5da416cf99d1b713e2

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1&C=1

Request Chain 132

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeWebmVaSn-.EZWmJUdXYQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO1hEUPgUmD4uWIuYMERDOA&google_cver=1&google_hm=2

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESELY3A1OxR-piP4ncQYqzDPI&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELY3A1OxR-piP4ncQYqzDPI%26google_cver%3D1

Request Chain 134

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2ODE1NjA2NTQ3OTgwMzg0Mg%3D%3D

Request Chain 154

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=23553600214937700951389011842021&t=htlp HTTP 301
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=23553600214937700951389011842021&actionid=731824&produktid=businessgiro&dt_url=

Request Chain 155

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=23553600214937700951389011842021&ra_cnt_active=1&ra_cnt=1 HTTP 302
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716

Request Chain 156

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804

Request Chain 158

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=23553600214937700951389011842021 HTTP 301
https://ad-server.eu/wm/pb/native.png

Request Chain 178

https://www.awin1.com/cshow.php?s=2846681&v=14098&q=409715&r=296283&pref1=77305900219363502179199011842017&pv=0 HTTP 302
https://media.kaspersky.com/de/affiliates/evergreen-kis-300x250.jpg

203 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
gursesintour.com/
Redirect Chain

http://gursesintour.com/
https://gursesintour.com/

328 KB
42 KB

254ms
129ms

Document
text/html

5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

ae68b729dc67726d8cc7649f1e32bfd7623a098753d96bcff6562b1256843809

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9

Response headers

server: nginx
date: Mon, 17 Jan 2022 16:50:51 GMT
content-type: text/html; charset=UTF-8
content-length: 42316
vary: Accept-Encoding,Cookie,User-Agent
cache-control: max-age=3, must-revalidate
content-encoding: gzip
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;
x-content-type-options: nosniff

Redirect headers

Server: nginx
Date: Mon, 17 Jan 2022 16:50:51 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://gursesintour.com/
X-Hosted-By: http://agho.st
Strict-Transport-Security: max-age=63072000; includeSubdomains;
X-Content-Type-Options: nosniff

GET
H2 200 style.min.css
gursesintour.com/wp-includes/css/dist/block-library/ 57 KB
11 KB 130ms
129ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.5

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 10:48:36 GMT
server: nginx
etag: W/"609e5584-e33b"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 styles.css
gursesintour.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 67ms
66ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.3

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 28 Nov 2021 09:55:57 GMT
server: nginx
etag: W/"61a3522d-aab"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 theme-my-login.min.css
gursesintour.com/wp-content/plugins/theme-my-login/assets/styles/ 1 KB
691 B 130ms
129ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/theme-my-login/assets/styles/theme-my-login.min.css?ver=7.1.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

f77676010af045f74f15412f1ca9b418478066304101556281c5b4e162932525

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 Aug 2020 12:36:49 GMT
server: nginx
etag: W/"5f368561-48a"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 postratings-css.css
gursesintour.com/wp-content/plugins/wp-postratings/css/ 1 KB
653 B 131ms
129ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/wp-postratings/css/postratings-css.css?ver=1.89

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

c56b566e17c62870ce139b3a57bfb94a9d785792bd6ac2220d52426b8590d87f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 Aug 2020 12:43:39 GMT
server: nginx
etag: W/"5f3686fb-549"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 style.css
gursesintour.com/wp-content/plugins/td-composer/td-multi-purpose/ 68 KB
12 KB 65ms
64ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=9e241c87ee8782e8f19bb886a935e653

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

962bba463fbc870e1d4e8a32dd01bf0d86af35502a83838f5224b138764e6911

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:14:14 GMT
server: nginx
etag: W/"5c1695f6-111dc"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 css
fonts.googleapis.com/ 38 KB
2 KB 189ms
69ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed%3A400%2C300%2C700%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700%2C300%7CRoboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900&ver=9.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

010f9e05be3faa0246f4906f801bb039cd6572512ccee425125bfce4d6597c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 16:47:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 17 Jan 2022 16:50:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jan 2022 16:50:51 GMT

GET
H2 200 style.css
gursesintour.com/wp-content/themes/Newspaper/ 1 MB
174 KB 90ms
89ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/themes/Newspaper/style.css?ver=9.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

8bb03ea2b79c17ecd939b74449a322f9f70d98587347c91467f4d03c4963ccfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:07:34 GMT
server: nginx
etag: W/"5c169466-12c70a"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 demo_style.css
gursesintour.com/wp-content/themes/Newspaper/includes/demos/city_news/ 3 KB
1009 B 66ms
65ms Stylesheet
text/css 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/themes/Newspaper/includes/demos/city_news/demo_style.css?ver=9.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

f17086e2aabf6767e7f89afa09bcecd3926b3635f3d9d47f87d50f574db7b6fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:10:00 GMT
server: nginx
etag: W/"5c1694f8-d26"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 jquery.min.js Show response
gursesintour.com/wp-includes/js/jquery/ 87 KB
35 KB 130ms
129ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 10:48:36 GMT
server: nginx
etag: W/"609e5584-15d98"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 jquery-migrate.min.js Show response
gursesintour.com/wp-includes/js/jquery/ 11 KB
5 KB 65ms
64ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 10:48:36 GMT
server: nginx
etag: W/"609e5584-2bd8"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 146 KB
51 KB 196ms
76ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a623062bbb8f8e98f0b6d0cef42991661dd6eb36afcc8e08c2eef645eaf7d37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51978
x-xss-protection: 0
server: cafe
etag: 7658192674571086819
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 system_domain.js Show response
admessage.support/ 32 KB
16 KB 815ms
56ms Script
application/javascript 67.207.77.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://admessage.support/system_domain.js
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 67.207.77.125 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.17.1 /
Resource Hash: 33f9d0917b2dac40e75a74cad23476ca18ba0c3127ae67c6ee6f6e3d850c2189

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
last-modified: Wed, 17 Apr 2019 17:03:22 GMT
server: nginx/1.17.1
etag: W/"5cb75c5a-7e05"
vary: Accept-Encoding
content-type: application/javascript
x-robots-tag: noindex, nofollow, noarchive, nosnippet, noodp, notranslate, noimageindex

GET
H2 200 script.js Show response
k0r2eokjm6.ru/ 107 KB
42 KB 423ms
220ms Script
application/javascript 85.192.12.170
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://k0r2eokjm6.ru/script.js
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.192.12.170 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 45e0931c4fdc7533cfa9a120038b42db5c9c366fcbabbd89acd84f001ab29490

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-adsbid-request: gm_1uxjuyqdn
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
server: nginx/1.18.0

GET
H2 200 wp-emoji-release.min.js Show response
gursesintour.com/wp-includes/js/ 14 KB
5 KB 66ms
59ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/wp-emoji-release.min.js?ver=5.7.5

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 May 2021 10:48:36 GMT
server: nginx
etag: W/"609e5584-3795"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 tech-header.png
gursesintour.com/wp-content/uploads/2018/12/ 10 KB
11 KB 67ms
60ms Image
image/png 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2018/12/tech-header.png

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

11b5ef79ac01ac3562dff2724e3400ddfc580e60248c22a5e1fef5189747e592

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:42:09 GMT
server: nginx
etag: "5c169c81-292c"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/png
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 10540

GET
H2 200 asu1-324x235.jpg
gursesintour.com/wp-content/uploads/2022/01/ 15 KB
15 KB 69ms
63ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu1-324x235.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

b6d30c7e11f051f84febcc8a5ed1d174c68338a36ace4736593d542a9bdeed5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:29 GMT
server: nginx
etag: "61e532fd-3a22"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 14882

GET
H2 200 kpt7-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 68ms
62ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpt7-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

52b0afa372af7cfa3af9e5d58e3f75fe7a1ff812b5ee43df275aeba3579a693d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 Jan 2022 11:35:32 GMT
server: nginx
etag: "61e2b184-a1b"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2587

GET
H2 200 kpt4-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 68ms
61ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpt4-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

48e3f53a83b8699bb168a12bfa50430fc461687ca9a93bcf757eb35877adfd4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 Jan 2022 11:35:34 GMT
server: nginx
etag: "61e2b186-a36"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2614

GET
H2 200 orc2-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
3 KB 68ms
62ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/orc2-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

20b74de0626386609ecd0154d8f2bdbef356d55426b9cf7bf258da8ae9b7401d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Jan 2022 08:30:49 GMT
server: nginx
etag: "61e134b9-957"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2391

GET
H2 200 rbp2-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
2 KB 67ms
61ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/rbp2-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

4693f068f338a05cf90e7a9be3d4754cf7303411a9503e1a08f9ea37db30ff19

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Thu, 13 Jan 2022 08:32:11 GMT
server: nginx
etag: "61dfe38b-7b5"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 1973

GET
H2 200 ird2-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 132ms
125ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/ird2-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

4a65567f19e8e78b56336e6e61fe45d55840fdf2b7c0a5e1ca076c3a15af3c3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 12 Jan 2022 08:16:10 GMT
server: nginx
etag: "61de8e4a-a9d"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2717

GET
H2 200 kbg1-534x307.jpg
gursesintour.com/wp-content/uploads/2022/01/ 36 KB
36 KB 131ms
124ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg1-534x307.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

92bab1b3797ce5864ebf34ac10727256e8f0a243a1d7c8cca72054efdd38a538

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 09:56:23 GMT
server: nginx
etag: "61e3ebc7-8ff1"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 36849

GET
H2 200 kbg1-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
3 KB 126ms
120ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg1-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

9a8fb669ba6cb6f0f90aa2091e09326c460d6541400cebc18b8057d0b955b5fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 09:56:23 GMT
server: nginx
etag: "61e3ebc7-962"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2402

GET
H2 200 kpt2-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 128ms
121ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpt2-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

02338ec47d818b6f268f8d0608c0d738fb5db255f3050b17d7822993445919ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 Jan 2022 11:35:36 GMT
server: nginx
etag: "61e2b188-acf"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2767

GET
H2 200 asu3-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 10 KB
10 KB 129ms
123ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu3-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

dcd4faf4bf75b6401f61eef5b9434a327ab8a187c0b429ea533d2faa8d8d78a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:25 GMT
server: nginx
etag: "61e532f9-27d3"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 10195

GET
H2 200 orc4-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 19 KB
19 KB 90ms
84ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/orc4-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

caf81c9196bab5349753b814f7ecba01fda07f18d2ced30df0199057e513655b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Jan 2022 08:30:48 GMT
server: nginx
etag: "61e134b8-4b84"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 19332

GET
H2 200 asu6-534x366.jpg
gursesintour.com/wp-content/uploads/2022/01/ 44 KB
45 KB 98ms
92ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu6-534x366.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

4a13ccb1992e423065f7bef88f57f171e746d53cd96cdb51dd13decc8c532678

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:18:15 GMT
server: nginx
etag: "61e53457-b100"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 45312

GET
H2 200 asu-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
2 KB 119ms
113ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

eecd4a4d074a4ba40515b99c3b5638dfe23c1272896f3c5c2a732f882a9c12d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:30 GMT
server: nginx
etag: "61e532fe-919"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2329

GET
H2 200 kbg3-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 95ms
89ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg3-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

4735133711335860e73767635c24ee650632154a838c09ddb1595c5184f11682

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 09:56:21 GMT
server: nginx
etag: "61e3ebc5-c93"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 3219

GET
H2 200 kbg-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 3 KB
3 KB 130ms
124ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

7b5a664070ab4b7a103220a5029d6d8d4101105cae1fead97f1d73f5c7741492

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 09:56:23 GMT
server: nginx
etag: "61e3ebc7-b8b"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2955

GET
H2 200 kpl7-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
2 KB 129ms
124ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpl7-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

8f7b33522a80d7c38f394351ff9d2981ef631714f43658f9d2edc13804150d53

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 10 Jan 2022 19:23:35 GMT
server: nginx
etag: "61dc87b7-6d3"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 1747

GET
H2 200 kpl-100x70.jpg
gursesintour.com/wp-content/uploads/2022/01/ 2 KB
2 KB 94ms
88ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpl-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

38a712b18f92c87ae5d1b0899b14ed9cb0ccfc4f9dfdf5422ade73b57c42640b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 10 Jan 2022 09:15:48 GMT
server: nginx
etag: "61dbf944-868"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 2152

GET
H2 200 sps2-100x70.jpg
gursesintour.com/wp-content/uploads/2019/07/ 3 KB
4 KB 96ms
90ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2019/07/sps2-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

f79c91ecc9669b069ab963959ddea67069bec8d65f85f6f2d2aee1b53a23b3fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 14:22:03 GMT
server: nginx
etag: "5d37180b-dca"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 3530

GET
H2 200 kmanu-100x70.jpg
gursesintour.com/wp-content/uploads/2019/02/ 4 KB
4 KB 92ms
87ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2019/02/kmanu-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

4884b638135815cdcdd22b9e6e82d6b5cc31f3c7e338beadc9b57ebab17a3e82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 01 Feb 2019 09:44:02 GMT
server: nginx
etag: "5c5414e2-e3e"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 3646

GET
H2 200 kibu-100x70.jpg
gursesintour.com/wp-content/uploads/2019/01/ 3 KB
3 KB 88ms
83ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2019/01/kibu-100x70.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

a5b8cd861e14c0534e35b254d7c5b052407781c08ba39cb9b12a3eb9cfe355c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 13 Jan 2019 10:11:42 GMT
server: nginx
etag: "5c3b0ede-cde"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 3294

GET
H2 200 zagakr-300x191.jpg
gursesintour.com/wp-content/uploads/2018/10/ 8 KB
8 KB 91ms
86ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2018/10/zagakr-300x191.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

6d2a2b7e44c01d1513799e41a1a060ac89160a54b8a57b6cc6d2f4ed0b7ed6ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 13 Oct 2018 19:12:27 GMT
server: nginx
etag: "5bc2439b-1fc0"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 8128

GET
H2 200 izispo-300x160.jpg
gursesintour.com/wp-content/uploads/2018/07/ 13 KB
14 KB 129ms
124ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2018/07/izispo-300x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

45b9cb36b814acbe935b2bb6359df41765dabdeec2fc2fe034357d03d395110a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Jul 2018 09:14:09 GMT
server: nginx
etag: "5b3b3e61-35f5"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 13813

GET
H2 200 sopavu-300x191.jpg
gursesintour.com/wp-content/uploads/2018/06/ 13 KB
13 KB 127ms
122ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2018/06/sopavu-300x191.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

93c5074560c4c64e70bd3f89e9cf27bcab97210f3dad0019afe6af050bbd69a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 11 Jun 2018 18:08:43 GMT
server: nginx
etag: "5b1ebaab-3309"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 13065

GET
H2 200 kbg4-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 10 KB
10 KB 124ms
119ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg4-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

328e4d28e98fb93cfa32d6fd8f3770e18492c9f8df76c32f0f9f3472fa7e276e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 11:36:48 GMT
server: nginx
etag: "61e40350-2622"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 9762

GET
H2 200 kpt7-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 11 KB
11 KB 128ms
123ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpt7-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

6e8b46d9219a1d55e71c59dd2128bba7983150c48d08ed75124fa74e2d792992

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 Jan 2022 11:35:32 GMT
server: nginx
etag: "61e2b184-2bfa"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 11258

GET
H2 200 kpt2-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 17 KB
17 KB 128ms
123ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kpt2-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

c76e22f55ca0ef562872870940dc4dd2986c6b0c99f6a2c72978181f70406cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sat, 15 Jan 2022 11:35:36 GMT
server: nginx
etag: "61e2b188-426b"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 17003

GET
H2 200 drt1-324x160.jpg
gursesintour.com/wp-content/uploads/2021/08/ 12 KB
12 KB 125ms
121ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/08/drt1-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

b170c8fbe1bf2f0ce0ff63b0da20b8eed70edd68c7fb73ac41aecd2f90d75d99

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 25 Aug 2021 07:56:08 GMT
server: nginx
etag: "6125f798-2e03"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 11779

GET
H2 200 kundu2-300x225.jpg
gursesintour.com/wp-content/uploads/2011/12/ 25 KB
26 KB 122ms
118ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2011/12/kundu2-300x225.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

06b15ac88c3a03c088d5a13562dd3b7d70374172b44bc2b9fcd2a8c736ac7880

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 09 Feb 2015 02:41:00 GMT
server: nginx
etag: "54d81e3c-658e"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 25998

GET
H2 200 mtu7-324x160.jpg
gursesintour.com/wp-content/uploads/2021/10/ 16 KB
16 KB 94ms
90ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/10/mtu7-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

6ea7b59b49b628792395b8ae59e9f257b5343142b8cc439e31ba42124abea863

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 01 Oct 2021 10:09:38 GMT
server: nginx
etag: "6156de62-40d1"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 16593

GET
H2 200 smp6-324x160.jpg
gursesintour.com/wp-content/uploads/2021/12/ 11 KB
11 KB 105ms
101ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/12/smp6-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

1cd6a2ddc706f3429b260970c5b9f6996b5fcefe28e4b7f879875d6ef79ee703

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 15 Dec 2021 08:26:53 GMT
server: nginx
etag: "61b9a6cd-2a0e"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 10766

GET
H2 200 vti4-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 13 KB
13 KB 86ms
82ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/vti4-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

887cb3ce7da176b5a0f52cfa39c478da29022e630db641b2d3178b022a37ced3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 07 Jan 2022 08:46:38 GMT
server: nginx
etag: "61d7fdee-34d3"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 13523

GET
H2 200 pvk10-324x160.jpg
gursesintour.com/wp-content/uploads/2021/08/ 11 KB
11 KB 89ms
85ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/08/pvk10-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

14469e457feb19f2deaeaa95bcf891e4c0f9251c7d7b231895564e0a0721861f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 02 Aug 2021 10:47:16 GMT
server: nginx
etag: "6107cd34-2cb4"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 11444

GET
H2 200 ird4-324x160.jpg
gursesintour.com/wp-content/uploads/2022/01/ 14 KB
15 KB 92ms
88ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/ird4-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

808d1f65aba5749919ce232a57a7873a94057a96dd1abb5912a07190a79b551b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 12 Jan 2022 08:16:09 GMT
server: nginx
etag: "61de8e49-3997"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 14743

GET
H2 200 klo-324x160.jpg
gursesintour.com/wp-content/uploads/2021/05/ 13 KB
14 KB 129ms
125ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/05/klo-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

f9962dc81702799822919e862a8a09b9e55950e39c47c8b28345e21db2586648

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 10:00:35 GMT
server: nginx
etag: "60ab7943-3548"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 13640

GET
H2 200 opn4-324x160.jpg
gursesintour.com/wp-content/uploads/2021/10/ 8 KB
8 KB 130ms
126ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/10/opn4-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

197d58a862ea91422e76b59f3e2dde78b892ec7f1746ca6be666d016ebb6622e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 22 Oct 2021 08:12:00 GMT
server: nginx
etag: "61727250-20ec"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 8428

GET
H2 200 oos6-324x160.jpg
gursesintour.com/wp-content/uploads/2021/10/ 16 KB
16 KB 129ms
126ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/10/oos6-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

0b871a763b8062ba855b553c95bddcc16a19fb8b00885db8dbb5c3d0978f6804

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Oct 2021 09:04:55 GMT
server: nginx
etag: "61767337-40ec"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 16620

GET
H2 200 xli8-324x160.jpg
gursesintour.com/wp-content/uploads/2021/12/ 12 KB
12 KB 129ms
125ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/12/xli8-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

bfe13e2a23ad343324757b45fb29919a5d2d8a32ad5504e1e317116f1a577a23

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 13 Dec 2021 09:07:33 GMT
server: nginx
etag: "61b70d55-2e35"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 11829

GET
H2 200 izt2-324x160.jpg
gursesintour.com/wp-content/uploads/2021/07/ 11 KB
12 KB 129ms
125ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2021/07/izt2-324x160.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

e8644cfe5394b9cff4dd9dad2f3e5cbff31338aeb61beb7c32c886f0462ccb7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Jul 2021 10:00:27 GMT
server: nginx
etag: "60eeb5bb-2d31"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 11569

GET
H2 200 asu6-218x150.jpg
gursesintour.com/wp-content/uploads/2022/01/ 9 KB
9 KB 129ms
126ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu6-218x150.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

a5130a2e12db1d4c160e0db44c12ec2404d451a7ed5ffd1da2627e8c72bfe14f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:18:15 GMT
server: nginx
etag: "61e53457-24a5"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 9381

GET
H2 200 asu3-218x150.jpg
gursesintour.com/wp-content/uploads/2022/01/ 8 KB
8 KB 130ms
127ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu3-218x150.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

7dc250a9c098fe83e9ae4f0313c3238c18fd17a971e00d36812441f9e4ce98f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:25 GMT
server: nginx
etag: "61e532f9-1f4f"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 8015

GET
H2 200 asu1-218x150.jpg
gursesintour.com/wp-content/uploads/2022/01/ 8 KB
8 KB 130ms
127ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu1-218x150.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

31abf7a15fd48a7c7f73864edd2fc9553a33dc27fa40759b5a6d2b78487924bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:28 GMT
server: nginx
etag: "61e532fc-1ea9"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 7849

GET
H2 200 asu-218x150.jpg
gursesintour.com/wp-content/uploads/2022/01/ 7 KB
8 KB 129ms
127ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/asu-218x150.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

e321098f4c6ffe0dc55e4b925d7b162bc04ab062fa8247ac62d36ffe8c3617fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Jan 2022 09:12:30 GMT
server: nginx
etag: "61e532fe-1d39"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 7481

GET
H2 200 kbg3-218x150.jpg
gursesintour.com/wp-content/uploads/2022/01/ 10 KB
11 KB 130ms
127ms Image
image/jpeg 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/uploads/2022/01/kbg3-218x150.jpg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

0a71fcdbef44597ab39e930e1d4d6f19b516e0e8af8ad184aea52d41c81128fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Jan 2022 09:56:21 GMT
server: nginx
etag: "61e3ebc5-2989"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/jpeg
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 10633

GET
H2 200 wp-polyfill.min.js Show response
gursesintour.com/wp-includes/js/dist/vendor/ 97 KB
39 KB 63ms
62ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 13 Aug 2020 21:08:47 GMT
server: nginx
etag: W/"5f35abdf-183ee"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 index.js Show response
gursesintour.com/wp-content/plugins/contact-form-7/includes/js/ 12 KB
4 KB 61ms
60ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.3

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 28 Nov 2021 09:55:57 GMT
server: nginx
etag: W/"61a3522d-2e56"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 theme-my-login.min.js Show response
gursesintour.com/wp-content/plugins/theme-my-login/assets/scripts/ 2 KB
1 KB 60ms
60ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/theme-my-login/assets/scripts/theme-my-login.min.js?ver=7.1.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

5cbaa50905cbfd614dc889e6155550145a3ed92a0085f7cbfcdd5df69145dfdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 Aug 2020 12:36:49 GMT
server: nginx
etag: W/"5f368561-6cb"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 postratings-js.js Show response
gursesintour.com/wp-content/plugins/wp-postratings/js/ 3 KB
1 KB 60ms
60ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/wp-postratings/js/postratings-js.js?ver=1.89

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

c42425f18923921089911e70f39c6dd462794df2e42ac0596abc3884da6471fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 14 Aug 2020 12:43:39 GMT
server: nginx
etag: W/"5f3686fb-d01"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 postviews-cache.js Show response
gursesintour.com/wp-content/plugins/wp-postviews/ 133 B
427 B 63ms
63ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/plugins/wp-postviews/postviews-cache.js?ver=1.68

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

aa8ab2153beec5132d9268e321035fbee7f935ddcf90294ceb3424f7fe3e5405

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 15 Mar 2019 08:44:35 GMT
server: nginx
etag: "85-5841e0c635bbf-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
x-accel-version: 0.01
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;
accept-ranges: bytes
content-length: 121

GET
H2 200 tagdiv_theme.min.js Show response
gursesintour.com/wp-content/themes/Newspaper/js/ 205 KB
60 KB 67ms
67ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/themes/Newspaper/js/tagdiv_theme.min.js?ver=9.1

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

5ec72ee4f704bfdea70d2ea0471b7629cced6708346b7783f3a0ef0ad43f027a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:07:38 GMT
server: nginx
etag: W/"5c16946a-332d4"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 comment-reply.min.js Show response
gursesintour.com/wp-includes/js/ 3 KB
2 KB 61ms
61ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/comment-reply.min.js?ver=5.7.5

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 15 Apr 2021 09:56:01 GMT
server: nginx
etag: W/"60780db1-ba8"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 wp-embed.min.js Show response
gursesintour.com/wp-includes/js/ 1 KB
1010 B 62ms
56ms Script
application/javascript 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-includes/js/wp-embed.min.js?ver=5.7.5

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 15 Apr 2021 09:56:01 GMT
server: nginx
etag: W/"60780db1-592"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;

GET
H2 200 b286ae57.js Show response
pxksnymto.ru/pixels/ 139 KB
48 KB 437ms
223ms Script
application/javascript 85.192.12.173
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pxksnymto.ru/pixels/b286ae57.js
Requested by: Host: k0r2eokjm6.ru
URL: https://k0r2eokjm6.ru/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.192.12.173 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 9fd72153ba3e8a36d7e6a93d9bd5acb61f8f1cde905b95955a10761aa7e3636d

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
cache-control: no-store
last-modified: Mon, 20 Dec 2021 09:18:45 GMT
server: nginx/1.18.0
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 105 KB
40 KB 197ms
79ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5FQGKH

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eaec5f0d1a81fb864cc6cdc2fcc24495d25bc5430eeb906c79289a4caa576b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40872
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 newspaper.woff
gursesintour.com/wp-content/themes/Newspaper/images/icons/ 22 KB
22 KB 121ms
120ms Font
application/x-font-woff 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?15

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/wp-content/themes/Newspaper/style.css?ver=9.1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

5b56f14bb63fc412aec1562ff5b4807919a486491f2e9a86054ef08922c634d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Referer: https://gursesintour.com/wp-content/themes/Newspaper/style.css?ver=9.1
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 16 Dec 2018 18:07:52 GMT
server: nginx
etag: "5c169478-5630"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: application/x-font-woff
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 22064

GET
H2 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v19/ 15 KB
15 KB 317ms
191ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed%3A400%2C300%2C700%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700%2C300%7CRoboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900&ver=9.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 14:17:54 GMT
x-content-type-options: nosniff
age: 527578
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15720
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:08:56 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 11 Jan 2023 14:17:54 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 306ms
180ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 13:39:48 GMT
x-content-type-options: nosniff
age: 270664
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 13:39:48 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 179ms
56ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 13:52:02 GMT
x-content-type-options: nosniff
age: 269930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 13:52:02 GMT

GET
H2 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19a7DRs5.woff2
fonts.gstatic.com/s/robotocondensed/v19/ 10 KB
10 KB 322ms
202ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVl2ZhZI2eCN5jzbjEETS9weq8-19a7DRs5.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a665b3ad14cb2075a396c2c542ea83c928fbcfb08160330bdec73177c63cc97e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 17:58:32 GMT
x-content-type-options: nosniff
age: 427940
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9908
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:08:53 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 17:58:32 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v29/ 9 KB
10 KB 327ms
209ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 04:11:53 GMT
x-content-type-options: nosniff
age: 304739
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 04:11:53 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 221ms
117ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 13:21:56 GMT
x-content-type-options: nosniff
age: 271736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17304
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 13:21:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 252ms
159ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 428073
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 17:56:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ 9 KB
9 KB 306ms
225ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 18:07:18 GMT
x-content-type-options: nosniff
age: 427414
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:33 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 18:07:18 GMT

GET
H2 200 KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 205ms
138ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a938256d2de59b044f8ca7c7aa0c788ed2ffa9a48bf0e3930a5830c4298f509

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 15 Jan 2022 20:59:46 GMT
x-content-type-options: nosniff
age: 157866
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17380
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sun, 15 Jan 2023 20:59:46 GMT

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCAYb8td.woff2
fonts.gstatic.com/s/robotocondensed/v19/ 10 KB
10 KB 202ms
201ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCAYb8td.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc40519e22545b5835214128bd107a8304e66096bf086b37e326a3659bf3711e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 02:46:35 GMT
x-content-type-options: nosniff
age: 482657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9832
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:08:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 02:46:35 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ 10 KB
10 KB 194ms
194ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d2ad11e3c1a0fd81bb085050d4b3170beab2964b5b848a5309a6343322e3898

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 10:03:58 GMT
x-content-type-options: nosniff
age: 456414
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9776
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:26 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 12 Jan 2023 10:03:58 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v19/ 15 KB
15 KB 185ms
185ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c867104326e3c4b658209d8e5bcea0900aaf7fbc2bbc181ca01c482cac2810f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 17:55:21 GMT
x-content-type-options: nosniff
age: 600931
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15640
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:08:37 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 10 Jan 2023 17:55:21 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v27/ 47 KB
47 KB 199ms
199ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 13:44:20 GMT
x-content-type-options: nosniff
age: 270392
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47836
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:32:23 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 13:44:20 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2
fonts.gstatic.com/s/opensans/v27/ 24 KB
24 KB 194ms
194ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcbd587432f5e88fc926d1cde0d375084b7f3e711f9ff34571dec52f70fb27cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 13:30:03 GMT
x-content-type-options: nosniff
age: 271249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24756
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:39 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 13:30:03 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2
fonts.gstatic.com/s/opensans/v27/ 30 KB
30 KB 174ms
173ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWvU6F15M.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b0b59b03fe12cb15256a60698dd6d9c715ff28733b2bbe6b426d895db1e57b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gursesintour.com
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 04:24:43 GMT
x-content-type-options: nosniff
age: 303969
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30260
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:32:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 04:24:43 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348
https://counter.yadro.ru/hit?q;t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348

224 B
710 B

101ms
101ms

Image
image/gif

88.212.201.216
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

HTTP/1.1

Server

88.212.201.216 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host216.rax.ru

Software

nginx/1.17.9 /

Resource Hash

489665aba7eee480b6b43a874675f73ba81cc3a7ef9b6c8bc893319812177efb

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:52 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 224
Expires: Sat, 16 Jan 2021 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:52 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;t16.6;r;s1600*1200*24;uhttps%3A//gursesintour.com/;0.002629837287749348
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sat, 16 Jan 2021 21:00:00 GMT

GET
H2 200 rating_over.gif
gursesintour.com/wp-content/plugins/wp-postratings/images/stars/ 523 B
774 B 60ms
59ms Image
image/gif 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gursesintour.com/wp-content/plugins/wp-postratings/images/stars/rating_over.gif

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

71348f4f38512af6e6ba8062fe5545a783f91d1a07bcb300c246f1bad9b0d4b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Aug 2020 12:43:39 GMT
server: nginx
etag: "20b-5acd5c52840c7"
strict-transport-security: max-age=63072000; includeSubdomains;
content-type: image/gif
x-accel-version: 0.01
x-hosted-by: http://agho.st
accept-ranges: bytes
content-length: 523

GET
H2 200 admin-ajax.php Show response
gursesintour.com/wp-admin/ 6 B
410 B 242ms
241ms XHR
text/html 5.9.195.152
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://gursesintour.com/wp-admin/admin-ajax.php?postviews_id=1199582&action=postviews&_=1642438251615

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.195.152 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

undefined.agho.st

Software

nginx /

Resource Hash

3f661b408ea4744a2ce766d66caaa3f6e2e794f1555cee78d1c0afdb56a55907

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://gursesintour.com/
X-Requested-With: XMLHttpRequest
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
x-hosted-by: http://agho.st
strict-transport-security: max-age=63072000; includeSubdomains;
x-robots-tag: noindex
vary: Accept-Encoding,User-Agent
content-length: 26
x-content-type-options: nosniff, nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H2 202 log Show response
rp-rep.net/api/ 0
597 B 198ms
86ms XHR
text/plain 2606:4700:3031::6815:1c44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rp-rep.net/api/log
Requested by: Host: admessage.support
URL: https://admessage.support/system_domain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:1c44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://gursesintour.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
allow: GET, POST, HEAD, OPTIONS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QRCFsaDJYg%2Fub1wTXymjT0RvdbBLp%2FMIHLSizPgRdThJNbuFA%2FMapRPdKvsEoxUJztxN%2BTgWBPC1bIkn6WmkoHX7KBc0atJ72F3562bqmgs5JKGX5IoJd%2FvZVg9TpauNtk5GPJU0GKoj"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6cf115c7af2072cc-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
DATA 200
OK truncated
/ Frame 2B85 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9563fdc19456cd77d4a8726af68cd4909cc4031208bc2eecda0a75942deec403

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 2B85 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ad770f7303d5654daf4d143d7b1b3bb746700bc1333497c9744f4f03ce42b91

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/ 284 KB
102 KB 147ms
84ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-0170365603936560&plah=gursesintour.com&bust=31064106

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94264e80d02aee478cab597737b2e4defdb90659167ceb87e82543494b98d9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104505
x-xss-protection: 0
server: cafe
etag: 8896997718913292229
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/ Frame 336A 11 KB
5 KB 171ms
53ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220112/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4885
x-xss-protection: 0
date: Mon, 17 Jan 2022 01:57:44 GMT
expires: Mon, 31 Jan 2022 01:57:44 GMT
cache-control: public, max-age=1209600
age: 53588
etag: 13671712056976469594
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 173ms
54ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5FQGKH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6586
date: Mon, 17 Jan 2022 15:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 17 Jan 2022 17:01:06 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 176ms
57ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: NVLygRpNGkx5eOR8cfbcNtd9gIaB8+pQoMdUpCPi2JdNxaLGu0EgKI+1RyMZHx5BbeDmGnnmMSfzbHfUctI6Jw==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 17 Jan 2022 16:50:52 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
secure.gravatar.com/avatar/ 4 KB
4 KB 142ms
45ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/?s=80&d=wavatar&r=g
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ac9ea1fd0fd23c2e48ce098da486d4168fa954f9a13585628c63e0958ebab977

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-nc: HIT lhr 4
date: Mon, 17 Jan 2022 16:50:52 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <http://www.gravatar.com/avatar/?s=80&d=wavatar&r=g>; rel="canonical"
content-length: 4012
expires: Mon, 17 Jan 2022 16:55:52 GMT

GET
H2 200 pclicks.js Show response
prodmp.ru/ 0
224 B 290ms
93ms Script
text/javascript 193.106.93.124
ITSOFT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prodmp.ru/pclicks.js
Requested by: Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.106.93.124 , Russian Federation, ASN48614 (ITSOFT-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
access-control-allow-credentials: true
server: nginx
content-type: text/javascript
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 npm-monitoring Show response
openfpcdn.io/fingerprintjs/v3.3.1/ 0
422 B 191ms
54ms XHR
text/plain 13.32.99.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://openfpcdn.io/fingerprintjs/v3.3.1/npm-monitoring

Requested by

Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.33 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-33.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 08:59:30 GMT
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Wed, 08 Dec 2021 08:59:30 GMT
server: CloudFront
age: 3484283
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: Hit from cloudfront
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=590808, s-maxage=30310003
x-amz-cf-pop: FRA60-P3
content-length: 0
x-amz-cf-id: __F54fUagZxbe3jk9BuDID_BUck9kqO-AIVa0_mov-LGchWoSa4Iew==

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 220 B
649 B 214ms
63ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=gursesintour.com&callback=_gfp_s_&client=ca-pub-0170365603936560

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-0170365603936560&plah=gursesintour.com&bust=31064106

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

5c3558189249bedee1672dafd3e00f5ff530e4f0379cbde217cd869ca8756058

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 198ms
63ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=gursesintour.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 182ms
65ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=gursesintour.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 35C8 0
19 B 205ms
142ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0170365603936560&output=html&adk=1812271804&adf=3025194257&lmt=1642438252&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fgursesintour.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252685&bpp=3&bdt=1315&idt=285&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=301

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A6C3 23 KB
10 KB 465ms
411ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

165c8039d2cc8cf5f2e8420826bae213206286afc153811f8333dbec0015de34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
content-length: 10021
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT
cache-control: private

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 124ms
62ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1571941666&t=pageview&_s=1&dl=https%3A%2F%2Fgursesintour.com%2F&ul=en-us&de=UTF-8&dt=%D0%93%D0%BB%D0%B0%D0%B2%D0%BD%D0%B0%D1%8F%20-%20%22gursesintour.com%22%20-%20%D0%BF%D0%BE%D0%B7%D0%BD%D0%B0%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%82%D1%83%D1%80%D0%B8%D1%81%D1%82%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAAABAAAAAC~&jid=1904396452&gjid=1833880879&cid=136266747.1642438253&tid=UA-59285794-1&_gid=33531349.1642438253&_r=1&gtm=2wg1c05FQGKH&z=1980139565

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://gursesintour.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://gursesintour.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 307937936649960 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 233ms
177ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/307937936649960?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c08152bb0e82623406aca0618b1e30d4b5b313f6bbc2485e737dc6d61ed7d1fc

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: tRd7+FRMaYJgSlGyI4KLmnXYOJ3ZmACmk7lcrx+gk74h80moaMuCMvpCas8YSfc0GBzhzvLyV/w4KgkW88NEQg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 17 Jan 2022 16:50:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B6C9 14 KB
7 KB 535ms
502ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=8889884284&adk=4224436493&adf=319921765&pi=t.ma~as.8889884284&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252690&bpp=1&bdt=1320&idt=325&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1077&ady=1028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4MC7K2WOCD&p=https%3A//gursesintour.com&dtd=328

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83c5b3e53fd69cf862fcdfd34a06fe7cc0fb26072235b1966fa02caae3a43eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
content-length: 7485
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 63FE 23 KB
10 KB 603ms
579ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1977825725&adk=3441218270&adf=1271596161&pi=t.ma~as.1977825725&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=333&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=650&ady=1486&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=Fe6YC4ISFC&p=https%3A//gursesintour.com&dtd=335

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac2ce0efc5a65861e27b78c6462d76fec331090913aa7fe4418d757684cbe3f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
content-length: 10061
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8790 436 B
236 B 541ms
535ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1890976066&adk=2959816976&adf=1772616195&pi=t.ma~as.1890976066&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=350&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=711&ady=2538&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=TTQhbWVLc8&p=https%3A//gursesintour.com&dtd=353

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3d3adde72232ced1d0afeb03403c8e9368519bfe3e69469be888802ff4bb12b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
content-length: 213
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT
cache-control: private

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
439 B 168ms
55ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-59285794-1&cid=136266747.1642438253&jid=1904396452&gjid=1833880879&_gid=33531349.1642438253&_u=YAhAAAAAAAAAAC~&z=2032096715

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gursesintour.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 17 Jan 2022 16:50:53 GMT
content-type: text/plain
access-control-allow-origin: https://gursesintour.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 internal Show response
dmpprof.com/matching/ 117 B
643 B 316ms
100ms Fetch
application/json 85.192.12.173
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dmpprof.com/matching/internal?event=view&aid=0&ssp_id=10&href=https%3A%2F%2Fgursesintour.com%2F&title=%D0%93%D0%BB%D0%B0%D0%B2%D0%BD%D0%B0%D1%8F%20-%20%22gursesintour.com%22%20-%20%D0%BF%D0%BE%D0%B7%D0%BD%D0%B0%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%82%D1%83%D1%80%D0%B8%D1%81%D1%82%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&dmp_print_id=75f67d020a6c2c4561d1ca4670345b0a
Requested by: Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.192.12.173 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: aaab41ab2c6f5e4cce9ad326a3893d03168c5e0d3cd9798f0854b1be8ca8f684

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
server: nginx/1.18.0
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, HEAD, PATCH, GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://gursesintour.com
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: true
access-control-allow-headers: Origin,Content-Type,Accept,Authorization,X-Requested-With, DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 117

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 164ms
55ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=307937936649960&ev=PageView&dl=https%3A%2F%2Fgursesintour.com%2F&rl=&if=false&ts=1642438253372&sw=1600&sh=1200&v=2.9.48&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1642438253371.291428934&it=1642438253013&coo=false&exp=p0&rqm=GET

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 17 Jan 2022 16:50:53 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame A6C3 2 KB
2 KB 214ms
84ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzQ3OTc0MjY4MDY1ODY0NDQ1OC82NjIyMzMyLzQ1NjIzMDYvNC9WTkdQLW02RGdRQ0tVUDJyLXNqMi1WcDQ2NDNSamJWamt6bVV3dEtKNHQ4LzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzQ3OTc0MjY4MDY1ODY0NDQ1OC9hbXMvMC8xMDA5Lzc0Lzk5OS8zMjIvMmEwMTo0YTA6MmM6Oi8wLjAwMC8xNjQyNDM4MjUzLzE2NDI0NTA4NTMvNC9wdWItMTkwNTQ1ODk2MTY1MzY3My8/CIZ35ohKtcEUOcNzi_0EBAkVzbk&nodeid=516&group=cdg&auctionid=479742680658644458&shardkey=479742680658644458&sid=4562306&cid=6622332&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%26client%3Dca-pub-1905458961653673%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 375b1733ee48b6f9b761b41476d76d92c5aa7c6065db11ce7a709e050cb39df3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1642438253
Last-Modified: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
x-mm-latency: 23 (1)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x70, cdg-bidder-x56
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame A6C3 2 KB
1 KB 185ms
66ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:48:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:48:37 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A6C3 121 KB
37 KB 804ms
659ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame A6C3 15 KB
7 KB 172ms
54ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:50:14 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A6C3 0
0 97ms
97ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5L2ibZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEvQFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVt4OAFh2x1J9WKVP5asgyQ-z0kl6JW05A43CVi6PZoekTkGGTPyLuABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xOTA1NDU4OTYxNjUzNjczGAA&sigh=bRwi-pGpUSQ&uach_m=[UACH]&cid=CAQSGwCNIrLMVuJPVtda4UWxEEeJUBk99Wv6O1RwihgB&tpd=AGWhJms1LDVZvWK7bexYfIkXxh_tkLqh76gT3pcacLnm1nFKtiJbAqKHuf9cCWxWCBLLobp-UqF46x9xiUDBT2RPt5WpMypt8cBGP0ulsvTWJssigbZ8NDo-RCiF7OaKmBfTWSzNMt9lV3bUjmbZoFigeF42SJU9CZZPbV2VIQA16MJk7gJ0kJzW8uEwtdGRWdmqb3tcBt0SwFyD2R7IBerQQOMvsEofzc9DRss-CcjMT491Ag_toRb2n0t6ngbLKKPZVGXGgAdMoE01nzQukuHs7Sbkg4r5_F3DzRun5Mwc2lX-DeE3WDpnjs0-UKzmanwGadsGjXs6ZA6u55u9BD3_ZbGiE8dlaNhlX-l_D0tvRwOtuz2YzkaRTugypbhOu9cSVIOlmA2f-zwqmrud1-10oZs7tR7yeJ69VrzzyGP_3oLYyknKLGR0hV3RXEpRGJoH1Sph1BLdptMUoy_lt_rws_Hl9b3dGEnnE8soqMFe5RMJEjFOPJgW2B_Q4JFhA1UsR6NcNbDg2h3BmRZh_1KIdIe_05Fyui_eSRyoaFNSfeuQgGzhGPiZkqBGkiHabF1oiGoXa5HhxjPlLQx3cdYL0R0iN-ykg-Zw6zpWGennPf2zOtj4Cap22mH_gzkIN8bwPe9-KmLQQ0huH-8JeesUem-vD3p09biBzE8eWt_u9W6eOOENS9GX_6Nl4xYk8gbldzEt_LQRhypgTRpi8UOUuWkGIPI-ewf0U15OcF1drQXHaKiL7gePOYAQJgzrGZp6MyNovyp48AMRg0oEXt-Ug1aXOf5RtxBqqVteWXWm9XiF19dTeBbuFbm3VU8qQeR9xNSP2BucDIRT_0hOJefeb5TCYfccrRPt9wNbLttF5_Q7jKUItKlxA0m3DrT9rOFP092Q5gqvp4RcUNQDuNx-VAvLPevVsPZV0qEwg0KeeBbZvTumDqr5qX-Q2RlJdE08XMea0PCT0qnFlUw3_0uOLJ1MJI-ahal09TwmuBhfbbn9rDMADf4v94T-2aLY12_kqd9Xl7aGrK3RNLmNKqj-eFPV5wLp4jSSCDEbn-uVYrPa_FAi33zDqGXodBRfjQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 17 Jan 2022 16:50:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 17 Jan 2022 16:50:53 GMT

GET
H2 200 demography Show response
prodmp.ru/pclicks/ 3 B
135 B 95ms
95ms Fetch
application/json 193.106.93.124
ITSOFT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prodmp.ru/pclicks/demography?domain=gursesintour.com
Requested by: Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.106.93.124 , Russian Federation, ASN48614 (ITSOFT-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://gursesintour.com
date: Mon, 17 Jan 2022 16:50:53 GMT
access-control-allow-credentials: true
server: nginx
content-length: 3
content-type: application/json

GET
H/1.1

200
OK

1px-matching-go2net.gif
m.trafmag.com/images/
Redirect Chain

https://inv-nets.admixer.net/adxcm.aspx?ssp=7E53F656-3653-491C-995F-4CD355497FC2&id=e78683af-8981-4383-8b0d-599b60d624f1
https://m.trafmag.com/images/1px-matching-go2net.gif?id=f7563efcfb614c5da416cf99d1b713e2

35 B
351 B

268ms
65ms

Image
image/gif

193.200.65.6
GIVEME-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.trafmag.com/images/1px-matching-go2net.gif?id=f7563efcfb614c5da416cf99d1b713e2
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: HTTP/1.1
Server: 193.200.65.6 Amsterdam, Netherlands, ASN6681 (GIVEME-CLOUD, PL),
Reverse DNS: adforce.team
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
P3P: CP="NON DSP COR CURa TIA"

Redirect headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: nginx
Access-Control-Allow-Origin: *
P3p: CP="NID DSP ALL COR"
Location: https://m.trafmag.com/images/1px-matching-go2net.gif?id=f7563efcfb614c5da416cf99d1b713e2
Access-Control-Allow-Credentials: true
Connection: keep-alive
Keep-Alive: timeout=25
Content-Length: 0
X-Xss-Protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B6C9 42 B
63 B 87ms
87ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CGVcFs9Taq6JFKT36eL0eErfn-4WU_PlK-9dkwRmPoLbBgk5EU_x8e78W8PZ14Jvax_ElhkCGEx1ngwouGL53N0qcfzfwRnT6EWQNltnly5wz-ds4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=8889884284&adk=4224436493&adf=319921765&pi=t.ma~as.8889884284&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252690&bpp=1&bdt=1320&idt=325&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1077&ady=1028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4MC7K2WOCD&p=https%3A//gursesintour.com&dtd=328

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame B6C9 2 KB
1 KB 96ms
68ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:48:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:48:37 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B6C9 121 KB
37 KB 753ms
701ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame B6C9 15 KB
6 KB 86ms
60ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:50:14 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A9F8 624 B
300 B 74ms
74ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKTpogIQudCjAhjt2IO-ATAB&v=APEucNUdiFX07oAtME4WWz4-ZUffz3bc5_bHcGqChYrbMkH65gxVmxmJRt3wB5snt7vWXQL2spvRBY_YYIZmU_-x14HkjtbRt2gs3zYnEeIEQWBpJYdBBNH0mQmal7p7gkqSOGS8jFgK1tdI9Yu5f1J01uRl4VjEtLFZy5Ejo9MczzqqmTK-jXE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=8889884284&adk=4224436493&adf=319921765&pi=t.ma~as.8889884284&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252690&bpp=1&bdt=1320&idt=325&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1077&ady=1028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4MC7K2WOCD&p=https%3A//gursesintour.com&dtd=328

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 17 Jan 2022 16:50:53 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 17 Jan 2022 16:50:53 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B6C9 82 KB
31 KB 132ms
132ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AUttMAWuIJXOpQjG-ajZTG0SHzidE_Q8C6rPzsGNKNKHvGpvxzITpKd9HM7ft-MzM1tqs5PG5VbWjR0pbGwkGHlLyIpWYw8JSVme23mIcxG7Rz0cgo4nyLxGSrWnYD67ktiPNGAgURLsgzBNUr31nUS2-eag&dbm_d=AKAmf-BhSBuKnnuwSkZg7SXFRn2j7yBPr5DjpBtuMPLy_OlmhA9ddv3C2Me_vG8CTJuEpNmCfdOwLCyyDLSmXdPxDMYiLWIjAgE4xWJOTqFz0kobYhtvlX9tuaLhqa7oka6AlNVhH58qlSjMlFO0A0FPcM76SvuvHURwjUWGTuPxNFb6BGOMDIBGfrKndYDYar36HeIreActEGmGPwQhE65c6-tG7h4CYwChU2dQf5QKP-8J9p03dtI2KSRoadBbJ_K_zULdkCQpTCcKAm1Q7uYDXplq6i0EA1tn2PsdrNBWNbEtPDdaif7Q6ty0i0Hh_e429Wa0M81GOU1cWb9ID3jEPJSwLbXj9eqAQBXMF2y_suT3F9wX364PBEljCJrE7BNf5nlp22zRUFEp2EzGeZOJc_TvSB3K1ZcbZLUgMdw1YI_TOpXcoccXb8FRYb0fgecsAakJztRvrbsqr0JYMUPSNNb8GFH2J0Pkp-7t51R8iz1bo5wuVKSqdFXChtNOuoWvHheYr6MbUm8Xg5tI3aWXvwIbA74x_njmbiMUoEi3IXLtl23NEoraNwXFXwW-nkL8CheqFYT47lqLd7j_uHgKM5DvB4OlvRYmzEUAuBh_Cu0XqMkL2MwsFdO7XJ3qEh39BYwlbcZY9hBLSdgwvSS6vynKzOIugeAqfAq504wO3YMJbGKH7Ms-k0PiyLzT2RdVHajsH33Tjih8gzYoJsFh2VR4iICFxR22wufbKN294sS5lQuXIFEibgrD8qNHftMw1eCl5JXvWSQUrP9QYlMMLl8nFS-w3rroti7KrQLQRgCZWU4z-FHm2igQJ61UiBdNYpRwYDtC4m0h0G0g2mv5aw9Aeym3Gy4ewjwop47lbfRLNPYcHrcEci3m903d5zp6ofUc9w7KEMG7CO7ER6AMHs3yWBxlojpyCFf4Ajuw1dPfSRRTvPeS1C3P1jVxEW88QS5BPSQozYA462f_zk19AKwXPDPkUn-hOBEUtPO9P-B4EgDjFdn3EcD908q6x-aUEDz7Z-omZUyaDyT8L80ESBx8crxG3wZ1iVDg-Fw1MIORmG-0kDUh6fwtYPyZ1ObgKF1p6PW0aGWDdAj59sA6fBF9eam68Y2TSijaq_nR93g_062WgNP6p6GybPlimPcTUma0j7K_LzrWUAeP1NC7XUvy33SWAKyzKSGWCNUUV5ct35DjGXqsUyQSjizniMHK2eLw0tDOXpp72E_3SaGZUpvgw8DCXzn5EEdNdQSvARs1Vw3hyhvpU_0bm7g_aByeBlf3xplDeUPwRlSqfgQZqtQRvGq4Mzj2Y4Z_UhYdJCoZFZDka1mO_UEEl2gZNa3GrDLTyjObOmI-O_ZJ54ZLU0yND0jQxrMroSAN2D9wWmVP6hBBa8jVEEtBcpicmtcnVKcECn3D1W6_bZp2JdbVATvEEAy8_rOPtnZBS8X-c2NQoynULV5R1nzLFEwl2O2dwn_ibdogMIjmBjENPrqGWGGzny6oBuPqThG6agopxVonfurLVW0_XpX3gMvTnKKX27b8kYZmbXTlWOfBrSqSHRFekB-gDeqAbjBr1cP3fxu3Q4sPape6s_enEMZslcBqmP2uTF3r1yhQ7S2HfMl-5Wk1KFDOgK2eBJxrmVRPp6FJpe9s_v0qbs0XrUufKLhXVn4gwYMqDLvx3NCj7G2UNu4aDvlq0IyuACGaeS9HZRISNbro91JcvAQ73fOx8bLzxhiXAUII2e08FkAH6--NreWreyUAvEHOUfRUw2_H0f2axsW0b6Ky1MWER7GkVJfWvu6t9h3TtmWcC3soPyFS0Lfl9k_ZozqtsY-kchUacXeTfBlP3wlxA33m48YCgThJGj7I4JsQVqsVmUplQ_msRrLm3ARb39PpM3zjKusNNiqyEWFPZh4hf-k6XGjFjvr3XfJXJD7cHUF3aobzI49A1z8kYp5V3TNPXfy6SadNGDmBkWfM6or6OyEJHe7aWZ7BQtbGG-sggneXO-z4oRVOZtRokAmhgPZS7GQJrTzhbEMYKTboVSs90xKXkcUUJN85eHc_IhQngPNjpeF1CqDFALoG2pyjSbwjITTRvKenwKSiHsX_Si-fTBfP04XUkGmPq87-ezvKPqIcrzNsGB3f-hBChM_q0o9osPLtrNNVXxS1928ZcmnRCbG_mokepf5Zi3zXpc2e_gaYUHovdaRY9zfaBVVPANZ3l1o2KO_E0tUzA1Cb01UGqPcdd_HKT-PaR936tojhwMYtV4w3gC-joC7jbxxi4n7bp1tH1DRgfzJwPdZD76zPHftaDbNXBJs4N9RvLrpX_v8c2b75IOq8IUc2HpKfWEe1wsGS0CHnRnPybvqJ19j8PAWp9j6N9bTYDInvktvym_0EbhP0Y74JqnOsJAFh0qrti8HpVt3XJvpLuQIBiLmUKIM4wyeZrftR2cbAK8TqJR7c3vNvXhSraXt1G-ANHx3ve8mW5X3W-aUZJKCF7WzFlNUzyUzLH0doBE0oyaYtcuE6Tch57J6XSVRF9VPMRM6oyMFAx84E8zAitnueD99UCKS4f_fTf1uh_QVOhanrBIzV40w4c3W3JVXNqmix31sty0sHTAnZJcxRLAv4sytVlxyQl22NiblxGFqBUArUjHDywFCfLXt0HAKZqSVHTzQDuc9lnL8jomxsmzExbKLXU0jqHmQKrZf3QX9jb-tSB8SLGjv2gh-v43thOuFMY22J_t2NugQzve7JdQE1xEs_KQxQ3EMQjAm9_IBleoxZx2R43zCFiASvWmgigW2J3J_291uU85eHlatnia3gb4yx-bPI0kNSIlD6Cgl2X4eheoTYpndAr0JYrpJwzc0TuUnQy3Wzc3heDY-SGBFs_lugIsa-3NbBLu3Tk0HObxcAJ-i-EgfRTfrc7nomg6GZm2PjQdRa-03Vz_EM-5H35xXhcdtSjsaqNPMVOsKF9Vzc&cid=CAASBORoEiQ&rfl=1%2Chttps%253A%252F%252Fgursesintour.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

182daa52de7ef4ee43d02475134f9c75998afc13cc41b3e48bf1be7e77bced69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=8889884284&adk=4224436493&adf=319921765&pi=t.ma~as.8889884284&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252690&bpp=1&bdt=1320&idt=325&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1077&ady=1028&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4MC7K2WOCD&p=https%3A//gursesintour.com&dtd=328
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31818
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 enr Show response
dmpprof.com/ 2 B
354 B 112ms
112ms Fetch
text/plain 85.192.12.173
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dmpprof.com/enr?href=https%3A%2F%2Fgursesintour.com%2F&title=%D0%93%D0%BB%D0%B0%D0%B2%D0%BD%D0%B0%D1%8F%20-%20%22gursesintour.com%22%20-%20%D0%BF%D0%BE%D0%B7%D0%BD%D0%B0%D0%B2%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9%20%D1%82%D1%83%D1%80%D0%B8%D1%81%D1%82%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB
Requested by: Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.192.12.173 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://gursesintour.com/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
server: nginx/1.18.0
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, HEAD, PATCH
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://gursesintour.com
access-control-allow-credentials: true
access-control-allow-headers: Origin,Content-Type,Accept,Authorization,X-Requested-With
content-length: 2

GET
H2 200 mapping Show response
dprof.site/matching/ 17 B
541 B 107ms
97ms Fetch
application/json 85.192.12.173
DINET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dprof.site/matching/mapping?uid=e78683af-8981-4383-8b0d-599b60d624f1
Requested by: Host: pxksnymto.ru
URL: https://pxksnymto.ru/pixels/b286ae57.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.192.12.173 , Russian Federation, ASN12695 (DINET-AS, RU),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:53 GMT
server: nginx/1.18.0
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, HEAD, PATCH, GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://gursesintour.com
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: true
access-control-allow-headers: Origin,Content-Type,Accept,Authorization,X-Requested-With, DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 17

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 63FE 2 KB
2 KB 203ms
83ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5Mzg1MDcxOTQ0NzkxODU0MzMvODY3NTYwOS8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVlsXzdJOGZzdzZ1ODdYRkhZVElRNG8vMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzM5Mzg1MDcxOTQ0NzkxODU0MzMvYW1zLzAvODAyNS84NC85OTkvMzIyLzJhMDE6NGEwOjJjOjovMC4wMDAvMTY0MjQzODI1My8xNjQyNDUwODUzLzQvcHViLTE5MDU0NTg5NjE2NTM2NzMv/ZICCK5oik76t1C1Ki8CFLzzSmkw&nodeid=516&group=cdg&auctionid=3938507194479185433&shardkey=3938507194479185433&sid=10023288&cid=8675609&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.89&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%26client%3Dca-pub-1905458961653673%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1977825725&adk=3441218270&adf=1271596161&pi=t.ma~as.1977825725&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=333&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=650&ady=1486&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=Fe6YC4ISFC&p=https%3A//gursesintour.com&dtd=335
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: daa74847c5bb4dc763a55e007ab49f84bfa8793fed4d2ffed0aa571d1b1c8edd

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1642438253
Last-Modified: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
x-mm-latency: 23 (1)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x30, cdg-bidder-x56
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 63FE 2 KB
1 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1977825725&adk=3441218270&adf=1271596161&pi=t.ma~as.1977825725&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=333&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=650&ady=1486&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=Fe6YC4ISFC&p=https%3A//gursesintour.com&dtd=335

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:48:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:48:37 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 63FE 121 KB
38 KB 620ms
619ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37895
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1641990413359145"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/ Frame 63FE 15 KB
6 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220112/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:50:14 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 63FE 0
0 97ms
97ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CRgXJbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExAFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1shwTrVccRU7pVWmKBX6TNhHm-4kLtW9HBgtQ0AQ5YhPvzM2HIvVV8gAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTkwNTQ1ODk2MTY1MzY3MxgA&sigh=XeI80sFAJOU&uach_m=[UACH]&cid=CAQSGwCNIrLMaMt5O_lZnveSzb2amUJ1QrGLAfq9RhgB&tpd=AGWhJmuHuHEfkJS1acbskaFSVaX8CoT7kz9OOHhiDSFjvuMZVv255tThxowbw_wWZzoQbvizZkoat3c0BIuGQ53qSOdNEAt459synhcQ8VHvUafK9y7diUheqk03N2hnCTPYKriVZbMw-Xdb8r2UsmKxJ-pBI8mBToFpFagv6fJeaLc4LdEWiMLl6P_8527vyF8KOr3nFnN8QYdsobZcw7mG1EvksyhGVkbJcWBPuoe2Jd0MGNGitXG1XOOxVpVhET6yT3XcWUwnbyLPcseM9sEuRE95OzID4yDI4X9hx26SaxRMTkxgYOJoY5BUAaH0bPW5sQZmfwh1AjctYpDDHgY9YwTOKWDD0tBmtIw3RWdI-qOH1XaY7fghfResMjfoWax171_0VNP1cjNT_kcCGzelX_yGTw--FWWTtlJE-LBvtRJ1yzyG_XF-PjTEa8p4cqQ9Htl8cJgzbZHyfsoN5_8LAynfQpClecGiuhwlLW7-RzOddIq4eDUldpgNldD0vY-hwFRiE7wF7lt2OljEULFE2tJheFoxzMBIx7cIiJ_ZDl7prO6_41MGn6oea8vibazAsFY8e6yE216brBvD8jLtP5XK6Ykfqa8FPLhpWgyEDBLC1ecOLoltZ5i97Cys2gy1b5qIrUmiMhW94_9pXj5AZcsa9zYutRIMh4yfu5F4KJwr9LBn20mSk29pFN2PMY9OohiB4An7wbQFjqoGXTIIrG3vp2izuoD_huM-GO9jjtPpSKm2QlfmikxhPpuzT_fmc3FCXWg8wj_If9pVii2IIyMfOOxJ0AG68GjIELaIBQMr8T31-_MGLCTEpPAGac3SQSlVP0eyM6PcJAoklI6h5KoGbIhmBCFRYB3dxFoE8u_XquspjC8dcVP_pb7Jw7-NbJucBKK6RRrGG6L_1GuyfgosX98FAFVJ50Kdbe0fR7Q6wprdnENJkDChBB2298D41_XkJfuLeJ7GfO4_Ush22jrrZto5DNIa3Mz-cnbbUJz-4C3pNrCCNuDccB2SD0udQhc2llpX0ziSWVwWqOUqDX3TFRmdlZ4EyUhh-UWL5D50OmnyVK4y7b9X-ibCBQYNaswWB9WY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=250&slotname=1977825725&adk=3441218270&adf=1271596161&pi=t.ma~as.1977825725&w=300&lmt=1642438253&psa=0&format=300x250&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252691&bpp=1&bdt=1321&idt=333&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C300x250&nras=1&correlator=5266221480320&frm=20&pv=1&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=650&ady=1486&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=Fe6YC4ISFC&p=https%3A//gursesintour.com&dtd=335
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 17 Jan 2022 16:50:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A9F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1&C=1

43 B
1014 B

73ms
73ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKTpogIQudCjAhjt2IO-ATAB&v=APEucNUdiFX07oAtME4WWz4-ZUffz3bc5_bHcGqChYrbMkH65gxVmxmJRt3wB5snt7vWXQL2spvRBY_YYIZmU_-x14HkjtbRt2gs3zYnEeIEQWBpJYdBBNH0mQmal7p7gkqSOGS8jFgK1tdI9Yu5f1J01uRl4VjEtLFZy5Ejo9MczzqqmTK-jXE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 16:50:54 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGN9jmCGIy0TIqL29iVAHMc&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A9F8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YeWebmVaSn-.EZWmJUdXYQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO1hEUPgUmD4uWIuYMERDOA&google_cver=1&google_hm=2

43 B
894 B

71ms
71ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO1hEUPgUmD4uWIuYMERDOA&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKTpogIQudCjAhjt2IO-ATAB&v=APEucNUdiFX07oAtME4WWz4-ZUffz3bc5_bHcGqChYrbMkH65gxVmxmJRt3wB5snt7vWXQL2spvRBY_YYIZmU_-x14HkjtbRt2gs3zYnEeIEQWBpJYdBBNH0mQmal7p7gkqSOGS8jFgK1tdI9Yu5f1J01uRl4VjEtLFZy5Ejo9MczzqqmTK-jXE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 16:50:54 GMT

Redirect headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEO1hEUPgUmD4uWIuYMERDOA&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame A9F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELY3A1OxR-piP4ncQYqzDPI&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELY3A1OxR-piP4ncQYqzDPI%26google_cver%3D1

43 B
1 KB

71ms
56ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELY3A1OxR-piP4ncQYqzDPI%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKTpogIQudCjAhjt2IO-ATAB&v=APEucNUdiFX07oAtME4WWz4-ZUffz3bc5_bHcGqChYrbMkH65gxVmxmJRt3wB5snt7vWXQL2spvRBY_YYIZmU_-x14HkjtbRt2gs3zYnEeIEQWBpJYdBBNH0mQmal7p7gkqSOGS8jFgK1tdI9Yu5f1J01uRl4VjEtLFZy5Ejo9MczzqqmTK-jXE

Protocol

HTTP/1.1

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
X-Proxy-Origin: 82.199.130.36; 82.199.130.36; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e72bc7bf-21c7-4100-bd5d-99a0f5143d12
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:53 GMT
X-Proxy-Origin: 82.199.130.36; 82.199.130.36; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 7a6b295a-cde1-4fd8-98a8-398840a38242
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELY3A1OxR-piP4ncQYqzDPI%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A9F8
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2ODE1NjA2NTQ3OTgwMzg0Mg%3D%3D

170 B
188 B

141ms
78ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2ODE1NjA2NTQ3OTgwMzg0Mg%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
X-Proxy-Origin: 82.199.130.36; 82.199.130.36; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 731ac2df-a117-4e08-8336-48082729fe2d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2ODE1NjA2NTQ3OTgwMzg0Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK ajk4xlebn4mw Show response
hal9000.redintelligence.net/zone/ Frame A6C3 10 KB
3 KB 189ms
60ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=479742680658644458&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c715a68bf204c3ab22940831dc8c7f4b7264f7791944125f7c90a5975bac608b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3285
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame A6C3 49 B
329 B 201ms
83ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=479742680658644458&node_id=516&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzQ3OTc0MjY4MDY1ODY0NDQ1OC82NjIyMzMyLzQ1NjIzMDYvNC9WTkdQLW02RGdRQ0tVUDJyLXNqMi1WcDQ2NDNSamJWamt6bVV3dEtKNHQ4LzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzQ3OTc0MjY4MDY1ODY0NDQ1OC9hbXMvMC8xMDA5Lzc0Lzk5OS8zMjIvMmEwMTo0YTA6MmM6Oi8wLjAwMC8xNjQyNDM4MjUzLzE2NDI0NTA4NTMvNC9wdWItMTkwNTQ1ODk2MTY1MzY3My8/CIZ35ohKtcEUOcNzi_0EBAkVzbk&nodeid=516&group=cdg&auctionid=479742680658644458&shardkey=479742680658644458&sid=4562306&cid=6622332&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x84, cdg-bidder-x56
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame A6C3 43 B
404 B 204ms
71ms Image
image/gif 2.18.233.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=479742680658644458&v3=651871&v4=4562306&v5=6622332&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzQ3OTc0MjY4MDY1ODY0NDQ1OC82NjIyMzMyLzQ1NjIzMDYvNC9WTkdQLW02RGdRQ0tVUDJyLXNqMi1WcDQ2NDNSamJWamt6bVV3dEtKNHQ4LzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzQ3OTc0MjY4MDY1ODY0NDQ1OC9hbXMvMC8xMDA5Lzc0Lzk5OS8zMjIvMmEwMTo0YTA6MmM6Oi8wLjAwMC8xNjQyNDM4MjUzLzE2NDI0NTA4NTMvNC9wdWItMTkwNTQ1ODk2MTY1MzY3My8/CIZ35ohKtcEUOcNzi_0EBAkVzbk&nodeid=516&group=cdg&auctionid=479742680658644458&shardkey=479742680658644458&sid=4562306&cid=6622332&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master cdg-pixel-x1 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MT3 4133 baa842e master cdg-pixel-x1 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame A6C3 49 B
329 B 200ms
81ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=479742680658644458&st=4562306&time=1642438253&nodeid=516
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzQ3OTc0MjY4MDY1ODY0NDQ1OC82NjIyMzMyLzQ1NjIzMDYvNC9WTkdQLW02RGdRQ0tVUDJyLXNqMi1WcDQ2NDNSamJWamt6bVV3dEtKNHQ4LzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzQ3OTc0MjY4MDY1ODY0NDQ1OC9hbXMvMC8xMDA5Lzc0Lzk5OS8zMjIvMmEwMTo0YTA6MmM6Oi8wLjAwMC8xNjQyNDM4MjUzLzE2NDI0NTA4NTMvNC9wdWItMTkwNTQ1ODk2MTY1MzY3My8/CIZ35ohKtcEUOcNzi_0EBAkVzbk&nodeid=516&group=cdg&auctionid=479742680658644458&shardkey=479742680658644458&sid=4562306&cid=6622332&bp=a_bgiccg&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.24&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x75, cdg-bidder-x56
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame B6C9 169 KB
59 KB 189ms
54ms Script
text/javascript 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 14:06:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9869
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 18 Jan 2022 14:06:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/ Frame B6C9 8 KB
3 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AUttMAWuIJXOpQjG-ajZTG0SHzidE_Q8C6rPzsGNKNKHvGpvxzITpKd9HM7ft-MzM1tqs5PG5VbWjR0pbGwkGHlLyIpWYw8JSVme23mIcxG7Rz0cgo4nyLxGSrWnYD67ktiPNGAgURLsgzBNUr31nUS2-eag&dbm_d=AKAmf-BhSBuKnnuwSkZg7SXFRn2j7yBPr5DjpBtuMPLy_OlmhA9ddv3C2Me_vG8CTJuEpNmCfdOwLCyyDLSmXdPxDMYiLWIjAgE4xWJOTqFz0kobYhtvlX9tuaLhqa7oka6AlNVhH58qlSjMlFO0A0FPcM76SvuvHURwjUWGTuPxNFb6BGOMDIBGfrKndYDYar36HeIreActEGmGPwQhE65c6-tG7h4CYwChU2dQf5QKP-8J9p03dtI2KSRoadBbJ_K_zULdkCQpTCcKAm1Q7uYDXplq6i0EA1tn2PsdrNBWNbEtPDdaif7Q6ty0i0Hh_e429Wa0M81GOU1cWb9ID3jEPJSwLbXj9eqAQBXMF2y_suT3F9wX364PBEljCJrE7BNf5nlp22zRUFEp2EzGeZOJc_TvSB3K1ZcbZLUgMdw1YI_TOpXcoccXb8FRYb0fgecsAakJztRvrbsqr0JYMUPSNNb8GFH2J0Pkp-7t51R8iz1bo5wuVKSqdFXChtNOuoWvHheYr6MbUm8Xg5tI3aWXvwIbA74x_njmbiMUoEi3IXLtl23NEoraNwXFXwW-nkL8CheqFYT47lqLd7j_uHgKM5DvB4OlvRYmzEUAuBh_Cu0XqMkL2MwsFdO7XJ3qEh39BYwlbcZY9hBLSdgwvSS6vynKzOIugeAqfAq504wO3YMJbGKH7Ms-k0PiyLzT2RdVHajsH33Tjih8gzYoJsFh2VR4iICFxR22wufbKN294sS5lQuXIFEibgrD8qNHftMw1eCl5JXvWSQUrP9QYlMMLl8nFS-w3rroti7KrQLQRgCZWU4z-FHm2igQJ61UiBdNYpRwYDtC4m0h0G0g2mv5aw9Aeym3Gy4ewjwop47lbfRLNPYcHrcEci3m903d5zp6ofUc9w7KEMG7CO7ER6AMHs3yWBxlojpyCFf4Ajuw1dPfSRRTvPeS1C3P1jVxEW88QS5BPSQozYA462f_zk19AKwXPDPkUn-hOBEUtPO9P-B4EgDjFdn3EcD908q6x-aUEDz7Z-omZUyaDyT8L80ESBx8crxG3wZ1iVDg-Fw1MIORmG-0kDUh6fwtYPyZ1ObgKF1p6PW0aGWDdAj59sA6fBF9eam68Y2TSijaq_nR93g_062WgNP6p6GybPlimPcTUma0j7K_LzrWUAeP1NC7XUvy33SWAKyzKSGWCNUUV5ct35DjGXqsUyQSjizniMHK2eLw0tDOXpp72E_3SaGZUpvgw8DCXzn5EEdNdQSvARs1Vw3hyhvpU_0bm7g_aByeBlf3xplDeUPwRlSqfgQZqtQRvGq4Mzj2Y4Z_UhYdJCoZFZDka1mO_UEEl2gZNa3GrDLTyjObOmI-O_ZJ54ZLU0yND0jQxrMroSAN2D9wWmVP6hBBa8jVEEtBcpicmtcnVKcECn3D1W6_bZp2JdbVATvEEAy8_rOPtnZBS8X-c2NQoynULV5R1nzLFEwl2O2dwn_ibdogMIjmBjENPrqGWGGzny6oBuPqThG6agopxVonfurLVW0_XpX3gMvTnKKX27b8kYZmbXTlWOfBrSqSHRFekB-gDeqAbjBr1cP3fxu3Q4sPape6s_enEMZslcBqmP2uTF3r1yhQ7S2HfMl-5Wk1KFDOgK2eBJxrmVRPp6FJpe9s_v0qbs0XrUufKLhXVn4gwYMqDLvx3NCj7G2UNu4aDvlq0IyuACGaeS9HZRISNbro91JcvAQ73fOx8bLzxhiXAUII2e08FkAH6--NreWreyUAvEHOUfRUw2_H0f2axsW0b6Ky1MWER7GkVJfWvu6t9h3TtmWcC3soPyFS0Lfl9k_ZozqtsY-kchUacXeTfBlP3wlxA33m48YCgThJGj7I4JsQVqsVmUplQ_msRrLm3ARb39PpM3zjKusNNiqyEWFPZh4hf-k6XGjFjvr3XfJXJD7cHUF3aobzI49A1z8kYp5V3TNPXfy6SadNGDmBkWfM6or6OyEJHe7aWZ7BQtbGG-sggneXO-z4oRVOZtRokAmhgPZS7GQJrTzhbEMYKTboVSs90xKXkcUUJN85eHc_IhQngPNjpeF1CqDFALoG2pyjSbwjITTRvKenwKSiHsX_Si-fTBfP04XUkGmPq87-ezvKPqIcrzNsGB3f-hBChM_q0o9osPLtrNNVXxS1928ZcmnRCbG_mokepf5Zi3zXpc2e_gaYUHovdaRY9zfaBVVPANZ3l1o2KO_E0tUzA1Cb01UGqPcdd_HKT-PaR936tojhwMYtV4w3gC-joC7jbxxi4n7bp1tH1DRgfzJwPdZD76zPHftaDbNXBJs4N9RvLrpX_v8c2b75IOq8IUc2HpKfWEe1wsGS0CHnRnPybvqJ19j8PAWp9j6N9bTYDInvktvym_0EbhP0Y74JqnOsJAFh0qrti8HpVt3XJvpLuQIBiLmUKIM4wyeZrftR2cbAK8TqJR7c3vNvXhSraXt1G-ANHx3ve8mW5X3W-aUZJKCF7WzFlNUzyUzLH0doBE0oyaYtcuE6Tch57J6XSVRF9VPMRM6oyMFAx84E8zAitnueD99UCKS4f_fTf1uh_QVOhanrBIzV40w4c3W3JVXNqmix31sty0sHTAnZJcxRLAv4sytVlxyQl22NiblxGFqBUArUjHDywFCfLXt0HAKZqSVHTzQDuc9lnL8jomxsmzExbKLXU0jqHmQKrZf3QX9jb-tSB8SLGjv2gh-v43thOuFMY22J_t2NugQzve7JdQE1xEs_KQxQ3EMQjAm9_IBleoxZx2R43zCFiASvWmgigW2J3J_291uU85eHlatnia3gb4yx-bPI0kNSIlD6Cgl2X4eheoTYpndAr0JYrpJwzc0TuUnQy3Wzc3heDY-SGBFs_lugIsa-3NbBLu3Tk0HObxcAJ-i-EgfRTfrc7nomg6GZm2PjQdRa-03Vz_EM-5H35xXhcdtSjsaqNPMVOsKF9Vzc&cid=CAASBORoEiQ&rfl=1%2Chttps%253A%252F%252Fgursesintour.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:50:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/ Frame B6C9 24 KB
9 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220112/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 31 Jan 2022 16:48:57 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B6C9 41 KB
15 KB 121ms
54ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 14:31:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Jan 2023 14:31:38 GMT

GET
H/1.1 200
OK r9d3a58lo9uw Show response
hal9000.redintelligence.net/zone/ Frame 63FE 10 KB
3 KB 177ms
60ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/r9d3a58lo9uw?subid=&gdpr=1&gdpr_consent=li&rnd=3938507194479185433&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACf2QKmquC7gE8uA%26mt_aid%3D3938507194479185433%26mt_id%3D8675609%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_cid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D
Requested by: Host: gursesintour.com
URL: https://gursesintour.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 312b08336d3ddc49a6b02d12661743f683e4283dfcb292fe5d8118aea4dc5fb4

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3283
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 63FE 49 B
329 B 119ms
73ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=3938507194479185433&node_id=516&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5Mzg1MDcxOTQ0NzkxODU0MzMvODY3NTYwOS8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVlsXzdJOGZzdzZ1ODdYRkhZVElRNG8vMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzM5Mzg1MDcxOTQ0NzkxODU0MzMvYW1zLzAvODAyNS84NC85OTkvMzIyLzJhMDE6NGEwOjJjOjovMC4wMDAvMTY0MjQzODI1My8xNjQyNDUwODUzLzQvcHViLTE5MDU0NTg5NjE2NTM2NzMv/ZICCK5oik76t1C1Ki8CFLzzSmkw&nodeid=516&group=cdg&auctionid=3938507194479185433&shardkey=3938507194479185433&sid=10023288&cid=8675609&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.89&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x84, cdg-bidder-x56
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 63FE 43 B
404 B 150ms
102ms Image
image/gif 2.18.233.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=3938507194479185433&v3=863182&v4=10023288&v5=8675609&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5Mzg1MDcxOTQ0NzkxODU0MzMvODY3NTYwOS8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVlsXzdJOGZzdzZ1ODdYRkhZVElRNG8vMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzM5Mzg1MDcxOTQ0NzkxODU0MzMvYW1zLzAvODAyNS84NC85OTkvMzIyLzJhMDE6NGEwOjJjOjovMC4wMDAvMTY0MjQzODI1My8xNjQyNDUwODUzLzQvcHViLTE5MDU0NTg5NjE2NTM2NzMv/ZICCK5oik76t1C1Ki8CFLzzSmkw&nodeid=516&group=cdg&auctionid=3938507194479185433&shardkey=3938507194479185433&sid=10023288&cid=8675609&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.89&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master cdg-pixel-x2 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MT3 4133 baa842e master cdg-pixel-x2 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 17 Jan 2022 16:50:52 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 63FE 49 B
329 B 128ms
82ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=3938507194479185433&st=10023288&time=1642438253&nodeid=516
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpreU1ETTRZell0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5Mzg1MDcxOTQ0NzkxODU0MzMvODY3NTYwOS8xMDAyMzI4OC80L0pmN044NWxEVW1CckhSQ1JMMHloQVlsXzdJOGZzdzZ1ODdYRkhZVElRNG8vMS80LzAvMC8xNzQ1MTAyLzAvMjQyODc2Lzg2MzE4Mi8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzM5Mzg1MDcxOTQ0NzkxODU0MzMvYW1zLzAvODAyNS84NC85OTkvMzIyLzJhMDE6NGEwOjJjOjovMC4wMDAvMTY0MjQzODI1My8xNjQyNDUwODUzLzQvcHViLTE5MDU0NTg5NjE2NTM2NzMv/ZICCK5oik76t1C1Ki8CFLzzSmkw&nodeid=516&group=cdg&auctionid=3938507194479185433&shardkey=3938507194479185433&sid=10023288&cid=8675609&bp=a_bidfbj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.89&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%26client%3Dca-pub-1905458961653673%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.211.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:53 GMT
Server: MMBD/3.211.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x67, cdg-bidder-x56
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Mon, 17 Jan 2022 16:50:52 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 6AA6 0
18 B 117ms
57ms Document
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://gursesintour.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://gursesintour.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Mon, 17 Jan 2022 16:50:53 GMT

GET
H/1.1 200
OK request.php Show response
hal900021.redintelligence.net/ Frame A6C3 3 KB
2 KB 275ms
136ms Script
application/x-javascript 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=91584de5a0&subid=&uid=84834ef3f9805a27&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D90%26slotname%3D4544125542%26adk%3D1731105763%26adf%3D193766564%26pi%3Dt.ma~as.4544125542%26w%3D728%26lmt%3D1642438252%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252688%26bpp%3D2%26bdt%3D1318%26idt%3D305%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D2%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D540%26ady%3D64%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CaE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DSv9SkLHVct%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D308&ancestorOrigins=null&random=4593706343439&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=479742680658644458&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 909730eff2cb5a0550fe7842076dde4ee015d5719ea1ac4553374279f16666cf

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 23553600214937700951389011842021
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1132
Expires: Mon, 17 Jan 2022 16:50:54 +0100

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FA9C 22 KB
8 KB 54ms
54ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 17 Jan 2022 14:31:40 GMT
expires: Tue, 17 Jan 2023 14:31:40 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 8353
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js Show response
pagead2.googlesyndication.com/bg/ Frame FA9C 35 KB
13 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdeeaca456001a6797d1256ce2e3be59f8229174301f475c1e0b9a88b7fcb1ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 07:40:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33036
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13313
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 17 Jan 2023 07:40:18 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/9616999278564081664/ Frame C9B0 2 MB
97 KB 152ms
90ms Document
text/html 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b29083ee81935db712459c36e5d1a2088c3b635f0b531e286febbc293a235a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:54 GMT
expires: Tue, 17 Jan 2023 16:50:54 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 21 Dec 2021 12:02:47 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B6C9 0
571 B 229ms
97ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_Vc8ixVpgIw1TdaitRGjA0HA6vil5O8YyyOqp6G5tX0vicKFKLI3W0iz5l_L-Yw9S6pmSSFLyxDUKU9UIlRtLVFpN8ddr46RjUPpMLjQ2OU_rP4LaF_pAcEN-5_mDC4ccqXO2rxCfjVM80OEBPd-cAuork4l5xi1Ig8oT6z7G31JdoyMb-Xzmmts-q9dt1rEycqoQAFQpwh4v4bP6LhXgZGoIuRA18sIz8LKQp81QJZpUy6UhNa2khTA3_9Y7V2g7n2sPJiVSuYDPgPZ0WoRebasQSevq0SeitutO4nl7LDnJHsunoJRn3poLNNE8kmDCTjeEf7tea2gLMi6Cqb0LulFWv6i1bfsT11ZXqD_i8gyPPPUDMzOnXGyFbR319kVdtemec0mMcj-_Ue9tv1Lu9wwzjaQ9wir6Ii_ROtgsMpMAxHontFzRUfiTP5Yrqx9HYrfkZ7aKQNrbe9ZSnbbS3XwgigQ_lRx2-SPtGOZJNthZL_MidxC0FpTwd8svDL_kSTuzyR2wTSISXedzYM3yRKTN9l4mlL-dUk1HZc7g_u8CJOV9VG4bXxr2nbuZM1VpHCli0H0JmKvgA3hBKA0bHkHwF7aDEknwkprLmp3ExyWhX0NLaU56XYPVpJv1MsrCQqZajv6u1KDjABkrFXolwvF03oIO1IwRjDRS0nrf2lYzHxU8OPcuzFaFfFkgvlx-52fY3vsk-1VsSd10vo6dklkuhLl7-D_tcoiRbVboxqwdtQZqGzl-OQMhvzVj5iml4yv2XwtzRWkT12U0Ah0gg-031t0kO-zFxqiin1UUL2VztcbzKwUdhjDRu73M7I3WJcp4PGAi9YcaTNErOk9Xd_RbesdYYkE4ORHLD2t3miD98_OK5esgMnX5UU7Mj7PCNAf3TA3ePSnOG8_mavTxw8tUBrRZP6VVGLIkcAP-mgObcq38i_y8xYXA56L_bbyP7mmW63YKRo1ZGRaWnb6e1QSDNWfjGbnYs9mWfzQDjwKYgDOr8JkPYa47tzVyjVb1Kj7ihpM6kKBJhF2tYMJ6ujQpt6r6WdIDveWUlE3RyjGTnfEq0hmdIElm7sykodLhDu8hUzK0CETGjhBWC1L9vu76k9B2br1t9X2iSlY8fhel9ZczfyfaWkt09sQ_Xr7J-AThDXKGHI3d4-DdvctkOn4-wrHiCN1Q5ZwL4g&sai=AMfl-YT38yCueA2895XyN7BiC-pQthQ57dGJqfOI1epm8MY9s5vo0XRyyi_MN2X3FPllT8PIvnpYZ8GwGQcTPE7EeIVCoWMx_6tRnxJNnjXxolAM4xHAQ5Eb6aY7QMgo7pXG5qln4lyvqaDsOduSJFdxH5XmnGE5&sig=Cg0ArKJSzFTY3bZ3qB_cEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=296&cbvp=1&cstd=291&cisv=r20220112.34278&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 17 Jan 2022 16:50:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK request.php Show response
hal900017.redintelligence.net/ Frame 63FE 2 KB
1 KB 241ms
106ms Script
application/x-javascript 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request.php?zone=r9d3a58lo9uw&nw=20&renderingType=javascript&namespace=4c2ec40983&subid=&uid=cad8922535bf7d12&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACf2QKmquC7gE8uA%26mt_aid%3D3938507194479185433%26mt_id%3D8675609%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_cid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D250%26slotname%3D1977825725%26adk%3D3441218270%26adf%3D1271596161%26pi%3Dt.ma~as.1977825725%26w%3D300%26lmt%3D1642438253%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252691%26bpp%3D1%26bdt%3D1321%26idt%3D333%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C728x90%252C300x250%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D1%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D650%26ady%3D1486%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CleEbr%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3DFe6YC4ISFC%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D335&ancestorOrigins=null&random=2916280605741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/r9d3a58lo9uw?subid=&gdpr=1&gdpr_consent=li&rnd=3938507194479185433&extVar[]=DOUBLEBORDER:1&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACf2QKmquC7gE8uA%26mt_aid%3D3938507194479185433%26mt_id%3D8675609%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_cid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: d78a8bf4354c9a218e8a513f3ea7ac2a3558f453b4e5c6e6edbbc6adeb0f4fea

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 77305900219363502179199011842017
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 724
Expires: Mon, 17 Jan 2022 16:50:54 +0100

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame D56D
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=23553600214937700951389011842021&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=23553600214937700951389011842021&actionid=731824&produktid=businessgiro&dt_url=

0
606 B

317ms
158ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=23553600214937700951389011842021&actionid=731824&produktid=businessgiro&dt_url=

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=91584de5a0&subid=&uid=84834ef3f9805a27&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D90%26slotname%3D4544125542%26adk%3D1731105763%26adf%3D193766564%26pi%3Dt.ma~as.4544125542%26w%3D728%26lmt%3D1642438252%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252688%26bpp%3D2%26bdt%3D1318%26idt%3D305%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D2%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D540%26ady%3D64%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CaE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DSv9SkLHVct%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D308&ancestorOrigins=null&random=4593706343439&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 17 Jan 2022 05:50:54 GMT
server: Microsoft-IIS/10.0
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 17 Jan 2022 16:50:53 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.21
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=23553600214937700951389011842021&actionid=731824&produktid=businessgiro&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: 52C78224:E01E_91EFC182:01BB_61E59E6E_CC76810:4417
X-IPLB-Instance: 40027
Cache-control: private

GET
H2

200

htlp Show response
futalis.de/ Frame 4AE9
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=23553600214937700951389011842021&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716

350 B
409 B

208ms
64ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=91584de5a0&subid=&uid=84834ef3f9805a27&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D90%26slotname%3D4544125542%26adk%3D1731105763%26adf%3D193766564%26pi%3Dt.ma~as.4544125542%26w%3D728%26lmt%3D1642438252%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252688%26bpp%3D2%26bdt%3D1318%26idt%3D305%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D2%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D540%26ady%3D64%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CaE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DSv9SkLHVct%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D308&ancestorOrigins=null&random=4593706343439&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

date: Mon, 17 Jan 2022 16:50:54 GMT
server: Apache
p3p: policyref="https://www.retailads.net//w3c/p3p.xml",CP="NOI CUR OUR STP"
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716
content-length: 0
content-type: text/html; charset=utf-8

GET
H3

200

activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804 Show response
5994599.fls.doubleclick.net/ Frame 5DCD
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804?

392 B
345 B

137ms
73ms

Document
text/html

172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804?

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f102.1e100.net

Software

cafe /

Resource Hash

18726375d8f009a477f99d374efc7ce34f7fb4ede57a4c3e5891c8d4d464e3c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 17 Jan 2022 16:50:54 GMT
expires: Mon, 17 Jan 2022 16:50:54 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 17 Jan 2022 16:50:54 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900021.redintelligence.net/ Frame E1D6 7 KB
2 KB 178ms
60ms Document
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=91584de5a0&subid=&uid=84834ef3f9805a27&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACP94CO8dFvAEr3Q%26mt_aid%3D479742680658644458%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_cid%3D5d6161e5-9e6d-4a01-a609-58c0ca88951a%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCv9s9bZ7lYZfLBsfG6wTglIiQBs-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoEwAFP0A0iWm-JoSCACoVhL6MWT-e5WfxijDvuwJRVk8pIlKWu25hK6UrG4z5Oel9NHkz7O8pR4tSDul1Z9FEHjiRPBUpEa77zFTprJptqKfjKSk66AfKjkl4koi2KyqPPmpGq1oBVxoz_XmIa3oZRdXa11LjGIFX_nDp4qYWXKzfsXsf-lIcpndmZoLh71rr7vIYEDnZ8DRVtouIkFcDJg9IH8Lbxakw_CyAwnR5c_YjZYeUiRwzJZGj8tv1zzzYJZnKABsrr6dDusIOqiQGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2pGv3V2e0lglkPzvn40kiwZWBM0g%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D90%26slotname%3D4544125542%26adk%3D1731105763%26adf%3D193766564%26pi%3Dt.ma~as.4544125542%26w%3D728%26lmt%3D1642438252%26psa%3D0%26format%3D728x90%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252688%26bpp%3D2%26bdt%3D1318%26idt%3D305%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D2%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D540%26ady%3D64%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CaE%257C%26abl%3DCA%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DSv9SkLHVct%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D308&ancestorOrigins=null&random=4593706343439&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 6727fe51144ebae36253d177d933281a75f2589461cedf11fb64ca1a4848e86d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 17 Jan 2022 16:50:54 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2066
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame A6C3
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=23553600214937700951389011842021
https://ad-server.eu/wm/pb/native.png

68 B
312 B

286ms
53ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1905458961653673&output=html&h=90&slotname=4544125542&adk=1731105763&adf=193766564&pi=t.ma~as.4544125542&w=728&lmt=1642438252&psa=0&format=728x90&url=https%3A%2F%2Fgursesintour.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1642438252688&bpp=2&bdt=1318&idt=305&shv=r20220112&mjsv=m202201120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5266221480320&frm=20&pv=2&ga_vid=136266747.1642438253&ga_sid=1642438253&ga_hid=1571941666&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=540&ady=64&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44750774%2C44753740%2C31064071%2C31064106&oid=2&pvsid=2193261437892792&pem=243&tmod=525&uas=0&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=Sv9SkLHVct&p=https%3A//gursesintour.com&dtd=308
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:56:07 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: 52C78224:E022_91EFC182:01BB_61E59E6E_CC76811:4417
X-Powered-By: PHP/7.2.21
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame A6C3 43 B
702 B 220ms
94ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=23553600214937700951389011842021&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FA9C 0
20 B 89ms
89ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BLCrmbZ7lYZWYJp_L7_UPzoiDuA8AAAAAOAHgBAI&bg=!pqWlpeHNAAaocxMpqHM7ACkAdvg8WrXNd085HCbOEomiRa1oTuIknU_2WN2OQOsGFY1GOJtsH74JogIAAABhUgAAAANoAQcKAFxPMnZFZToE5CG-LPgZdwkPqFP5Y4IUOHzi8PIUvNOdb_gb6BGVxQIlsM3w_WqhoMbwbcpOs5I-HNcXjVDWqO_P6koxeV3qoa3NTu5mTquqdGmGhC1TNdDLG7rpypkC6jPhCqWhrl92-S1url4RoFNbp63mleAshswS4aUBQc36leffnoBz3E8usSXowOKSLY6vj2leJEGXupiEBp3ajLPiw0rkPzl0AI8FlrKxIsQqYXkGyyUroOYg9EV1kNij8P_0lbEoqnus6XP5g23r0AGKxH-Ao3rUiUyKy5tBYMoO2gJGzqotCU5KEcEzC0-W-lwyw-rWSW4CH3QRbC_qamkD3pSUmRSX1TMzi4UVSGA7Zpvx8wiXLNonhGM6I8ykuBLR0so8-dVZLM9KthXSumxA4Xjri-ki4ZWp2VBwX27KChrlBHlfz_WM62IUd4-BD3FtYnOUZ5J7CAX3y5CT9u-S9euFg0O1vXGRisCOY1SJtSHzVPHY8q9KGiSlG6C2oy8dqI2hq0lxLzepsOBzt-RjSOnT9kHVvH6U2jfCSashMfxIV9rsWfitG-gQEklEuqVdzqac5HlOPFN5q5t9UmbvKDLQCBF1XThZS-ZhvY7_kZGWZeqy4ZnZxbtwzD-clWZQufJHXscK74GHIBDtejYFP2Lz4x39CYjHH41oSvQKfRDs6hr2SXEf_vY6yBB83jcpM7VAQNrT_Ni4XhgFLDHpR9pdEru-Nk_eEwDelV4UeDD8CUD0okgarP0P_XyfPj5WvKsR64PgEPZDip3GaHZh6fTyaUMJ1JO0X1PPil-t-sRaO8g6LwhlgJds-pG_aDSFIFaNheT-_kiOHcN5t3inWn4NPT4aPg3zf6q4-y-Ht4sBDFoLzMkNBULPkbkKNK0BL8-zQLthsoIhBfyE4IIiw58YMx8IkgUOPYUmJWompdDfiJ24NSBK4xPlf6qhcFBU1lcpIQ7Ufdp4XRw-JDnBeJOJOOeYoRiDQu9asYF9_ECniRgpuEfF1deN5D7AkwmKGXV9dY_H6iMiFgdIQlTkHMYKEPJ3oYuyv3RMROdUHbtfZB49KX-WozHUiCywtQ4hJuveWwbwJNDdpRB0tzoxR47R_t6FEt7p

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C9B0 4 KB
618 B 125ms
63ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500,regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 15:22:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 17 Jan 2022 16:50:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame C9B0 118 KB
40 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 14:56:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6848
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 18 Jan 2022 14:56:46 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900017.redintelligence.net/ Frame C695 7 KB
3 KB 191ms
61ms Document
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=r9d3a58lo9uw&nw=20&renderingType=javascript&namespace=4c2ec40983&subid=&uid=cad8922535bf7d12&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYeWebQACf2QKmquC7gE8uA%26mt_aid%3D3938507194479185433%26mt_id%3D8675609%26mt_adid%3D242876%26mt_sid%3D10023288%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_cid%3D5e6161e5-9e6d-4001-8de8-3d977947ab54%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCMOXXbZ7lYYLHBtrn6gSa6aLAAc-HjptcwIbZgsYCwI23ARABIABglQKCARdjYS1wdWItMTkwNTQ1ODk2MTY1MzY3M8gBCagDAaoExwFP0Nlg6CDmZ4lyP-jmNEPDBpqJkm18BSa6h56JFsil4ZwvpfzzB2M2pl2PCqd49qmH5ly9tuBRaCRzCTP8Bj_HVKiKban7Y0dTCTb0tuJVG2JrNuUJaQ1QeglaWPOCNk3rS2MqSsvD5jEEL1npeA6IsJnhCP0_sEG57XfhrUFItRsTgaPIQY_AIwffFqPTcbiIY3nD54etlyIHpp1sh0bpdFW97x5S18bJ9HyNK4mj9khRUf_ZY2n0QaGiJeXfK89RAVLxXy1UgAbqx4ewjce2-acBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_3mK2BuddiFsXUPeRQBpN0hD69Fwg%2526client%253Dca-pub-1905458961653673%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1905458961653673%26output%3Dhtml%26h%3D250%26slotname%3D1977825725%26adk%3D3441218270%26adf%3D1271596161%26pi%3Dt.ma~as.1977825725%26w%3D300%26lmt%3D1642438253%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fgursesintour.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1642438252691%26bpp%3D1%26bdt%3D1321%26idt%3D333%26shv%3Dr20220112%26mjsv%3Dm202201120101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C728x90%252C300x250%26nras%3D1%26correlator%3D5266221480320%26frm%3D20%26pv%3D1%26ga_vid%3D136266747.1642438253%26ga_sid%3D1642438253%26ga_hid%3D1571941666%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D650%26ady%3D1486%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44750774%252C44753740%252C31064071%252C31064106%26oid%3D2%26pvsid%3D2193261437892792%26pem%3D243%26tmod%3D525%26uas%3D0%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257CleEbr%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3DFe6YC4ISFC%26p%3Dhttps%253A%2F%2Fgursesintour.com%26dtd%3D335&ancestorOrigins=null&random=2916280605741&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: 0d1151458dc811f34103eab112c3e580ab1a0826ce7904c789a76e7e6fa6f6f9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 17 Jan 2022 16:50:54 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2313
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 63FE 43 B
702 B 165ms
85ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2846681&v=14098&q=409715&r=296283&pref1=77305900219363502179199011842017&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Jan 2022 16:50:54 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 css
fonts.googleapis.com/ Frame E1D6 1 KB
419 B 72ms
72ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 15:10:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 17 Jan 2022 16:50:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E1D6 10 KB
10 KB 196ms
66ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_627x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 413f46b30a937d320b50d51e5fccf47e47a4dac30b3aa3de568dbb19f0f7c9b9

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9783
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E1D6 10 KB
10 KB 194ms
64ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_627x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 140c5c48ad466ec51a4e3bc79859abdc5541e88e074da94b4450c368eb07a58b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10405
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E1D6 7 KB
8 KB 283ms
154ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/627x627.jpg
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1b7f4786a19f94a1c79b050735bd62209a8d1ed32dd7fa39c356b4786c472ace

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7630
Vary: Accept-Encoding
Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 63FE 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ac5faf060aa72af0983e581db842eef1c2072b5fdb58c026fe678e457651ff3

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A6C3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cf1876f6c817c02d6cf92eee6fc76ef3b1e046e7b0b5cf73d549902dfdaf056

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 iberia_text-regular.ttf
s0.2mdn.net/sadbundle/9616999278564081664/ Frame C9B0 82 KB
39 KB 55ms
54ms Font
font/ttf 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9616999278564081664/iberia_text-regular.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

894e24bf7cd3383660a98e70f31d2ea56c65555281a378d247640320cb7567d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40240
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 12:02:47 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 iberia-headlineNEW2.ttf
s0.2mdn.net/sadbundle/9616999278564081664/ Frame C9B0 150 KB
59 KB 64ms
63ms Font
font/ttf 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9616999278564081664/iberia-headlineNEW2.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbd0baa7584d58cb232c958aa33a527868ccaa7d5d1404cd149824b878bea6ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60776
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 12:02:47 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
DATA 200
OK truncated
/ Frame B6C9 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ede502472fff2aee0407620358471c77f19f4788af00830c4d6c4b4ae56f3f4c

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame E1D6 0
150 B 204ms
77ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=23553600214937700951389011842021&a=b017299d&vb=m
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C9B0 6 KB
4 KB 130ms
66ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a8f53b52944c9cce626f7ac366ef29eae54dab9d4379e1319323fd76a5de7dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4460
x-xss-protection: 0

GET
H3 200 prod_studio_01_247_configurablemodule.js Show response
s0.2mdn.net/879366/ Frame C9B0 31 KB
10 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_247_configurablemodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8460aaf36b73e229c6b0fcaf7bac791e23c3145e87de6a04d0d91541e39289b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 16 Jan 2022 23:52:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 61097
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10616
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 17 Jan 2022 23:52:37 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame C695 89 KB
32 KB 191ms
56ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 15 Jan 2022 22:26:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152674
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Jan 2023 22:26:20 GMT

GET
H2

200

evergreen-kis-300x250.jpg
media.kaspersky.com/de/affiliates/ Frame C695
Redirect Chain

https://www.awin1.com/cshow.php?s=2846681&v=14098&q=409715&r=296283&pref1=77305900219363502179199011842017&pv=0
https://media.kaspersky.com/de/affiliates/evergreen-kis-300x250.jpg

80 KB
80 KB

313ms
123ms

Image
image/jpeg

185.85.15.23
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.kaspersky.com/de/affiliates/evergreen-kis-300x250.jpg

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b

Protocol

Server

185.85.15.23 , Switzerland, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

06d9487d0d05b38994c2a06ab9639cfa33afe0c98f89cbb0f3bcefb4cfb0aa84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 12:09:27 GMT
server
x-powered-by: Kaspersky Labs, Kaspersky Labs
etag: "1b72585d61a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
x-xss-protection: 1; mode=block
x-server: fr1/FRA3
accept-ranges: bytes
content-length: 81829
date: Mon, 17 Jan 2022 16:50:53 GMT

Redirect headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://media.kaspersky.com/de/affiliates/evergreen-kis-300x250.jpg
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H3 200 dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804
adservice.google.com/ddm/fls/z/ Frame 5DCD 42 B
63 B 155ms
90ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJyf3KWfufUCFcIr0wodicQLUQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2993135805191.3804?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B6C9 0
23 B 171ms
93ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_Vc8ixVpgIw1TdaitRGjA0HA6vil5O8YyyOqp6G5tX0vicKFKLI3W0iz5l_L-Yw9S6pmSSFLyxDUKU9UIlRtLVFpN8ddr46RjUPpMLjQ2OU_rP4LaF_pAcEN-5_mDC4ccqXO2rxCfjVM80OEBPd-cAuork4l5xi1Ig8oT6z7G31JdoyMb-Xzmmts-q9dt1rEycqoQAFQpwh4v4bP6LhXgZGoIuRA18sIz8LKQp81QJZpUy6UhNa2khTA3_9Y7V2g7n2sPJiVSuYDPgPZ0WoRebasQSevq0SeitutO4nl7LDnJHsunoJRn3poLNNE8kmDCTjeEf7tea2gLMi6Cqb0LulFWv6i1bfsT11ZXqD_i8gyPPPUDMzOnXGyFbR319kVdtemec0mMcj-_Ue9tv1Lu9wwzjaQ9wir6Ii_ROtgsMpMAxHontFzRUfiTP5Yrqx9HYrfkZ7aKQNrbe9ZSnbbS3XwgigQ_lRx2-SPtGOZJNthZL_MidxC0FpTwd8svDL_kSTuzyR2wTSISXedzYM3yRKTN9l4mlL-dUk1HZc7g_u8CJOV9VG4bXxr2nbuZM1VpHCli0H0JmKvgA3hBKA0bHkHwF7aDEknwkprLmp3ExyWhX0NLaU56XYPVpJv1MsrCQqZajv6u1KDjABkrFXolwvF03oIO1IwRjDRS0nrf2lYzHxU8OPcuzFaFfFkgvlx-52fY3vsk-1VsSd10vo6dklkuhLl7-D_tcoiRbVboxqwdtQZqGzl-OQMhvzVj5iml4yv2XwtzRWkT12U0Ah0gg-031t0kO-zFxqiin1UUL2VztcbzKwUdhjDRu73M7I3WJcp4PGAi9YcaTNErOk9Xd_RbesdYYkE4ORHLD2t3miD98_OK5esgMnX5UU7Mj7PCNAf3TA3ePSnOG8_mavTxw8tUBrRZP6VVGLIkcAP-mgObcq38i_y8xYXA56L_bbyP7mmW63YKRo1ZGRaWnb6e1QSDNWfjGbnYs9mWfzQDjwKYgDOr8JkPYa47tzVyjVb1Kj7ihpM6kKBJhF2tYMJ6ujQpt6r6WdIDveWUlE3RyjGTnfEq0hmdIElm7sykodLhDu8hUzK0CETGjhBWC1L9vu76k9B2br1t9X2iSlY8fhel9ZczfyfaWkt09sQ_Xr7J-AThDXKGHI3d4-DdvctkOn4-wrHiCN1Q5ZwL4g&sai=AMfl-YT38yCueA2895XyN7BiC-pQthQ57dGJqfOI1epm8MY9s5vo0XRyyi_MN2X3FPllT8PIvnpYZ8GwGQcTPE7EeIVCoWMx_6tRnxJNnjXxolAM4xHAQ5Eb6aY7QMgo7pXG5qln4lyvqaDsOduSJFdxH5XmnGE5&sig=Cg0ArKJSzFTY3bZ3qB_cEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=838&vt=11&dtpt=542&dett=3&cstd=291&cisv=r20220112.34278&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:54 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 6645764697789685326
s0.2mdn.net/simgad/ Frame C9B0 5 KB
5 KB 70ms
69ms Image
image/png 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6645764697789685326

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

155791e15801f68c248ac66e85f4a1fb0273d5c156c3b28d28d11366bb75e9a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 02:02:44 GMT
x-content-type-options: nosniff
age: 571690
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4696
x-xss-protection: 0
last-modified: Mon, 03 Jan 2022 09:26:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Jan 2023 02:02:44 GMT

GET
H3 200 1320249868434329756
s0.2mdn.net/simgad/ Frame C9B0 11 KB
11 KB 70ms
69ms Image
image/png 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/1320249868434329756

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebc5d9fa5cf83cb90bd8f6f809e5bffdbecb8b4a8c408f522093e52c91aa0651

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 02:02:44 GMT
x-content-type-options: nosniff
age: 571690
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11371
x-xss-protection: 0
last-modified: Mon, 03 Jan 2022 09:29:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 11 Jan 2023 02:02:44 GMT

GET
H3 200 iberia_neg.svg
s0.2mdn.net/sadbundle/9616999278564081664/ Frame C9B0 5 KB
3 KB 70ms
69ms Image
image/svg+xml 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9616999278564081664/iberia_neg.svg

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5722dab9d2cbd31ed9153180623c7ec69e4b65fd7a213e2b0fa4be3a450335c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2597
x-xss-protection: 0
last-modified: Tue, 21 Dec 2021 12:02:47 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 13782839510306031844
s0.2mdn.net/simgad/ Frame C9B0 33 KB
33 KB 72ms
69ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/13782839510306031844

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17f18db89de2bf4b071bb5a1e645156b62eef2f165f0d72f13b912f1b57d2fbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34101
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:08:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 8417351732663967201
s0.2mdn.net/simgad/ Frame C9B0 28 KB
28 KB 74ms
72ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8417351732663967201

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73a5b3d9d1565b6c1438737a696c511ec44092f335856f92b5b896d44dbacd90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28995
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:08:28 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 269327100442893295
s0.2mdn.net/simgad/ Frame C9B0 27 KB
27 KB 132ms
130ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/269327100442893295

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a34e559739213b9e80ecd2c0c1c7d93bd3c08fcd90829d652853478f658b203b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27715
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:02:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 15417675587015209658
s0.2mdn.net/simgad/ Frame C9B0 76 KB
76 KB 98ms
96ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15417675587015209658

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1f80f474e4aef3be91ef7c340358092dd8cfb6995fb47ebc9594f25dbcfaddf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77679
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:08:59 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 7081536982350093670
s0.2mdn.net/simgad/ Frame C9B0 26 KB
26 KB 82ms
80ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7081536982350093670

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f970fce7da65c57fe5f33fa461ea5fe6e76ff129d68d537ee7d54625aa05cd26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26814
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:08:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 7077100068275930824
s0.2mdn.net/simgad/ Frame C9B0 13 KB
13 KB 126ms
125ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7077100068275930824

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca2fe0f124bddbb5d80ac8a219b748eb6511713ee291d271d7d7d71f184a0e59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13263
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:02:36 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 3269998901883559835
s0.2mdn.net/simgad/ Frame C9B0 8 KB
8 KB 130ms
128ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3269998901883559835

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d35df0cddd350fa02da8b7023894755150e758da14af45d5d4b8a7d90799d404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7686
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:02:28 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 6809714558886711527
s0.2mdn.net/simgad/ Frame C9B0 82 KB
82 KB 95ms
94ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/6809714558886711527

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6eef1e4f7a4116aa27af75d78ae566a6e8c986c16a09302e3b4ccb4441564aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84286
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:09:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H3 200 12249630584228344236
s0.2mdn.net/simgad/ Frame C9B0 94 KB
94 KB 92ms
90ms Image
image/jpeg 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12249630584228344236

Requested by

Host: gursesintour.com
URL: https://gursesintour.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36e1166d91aa3f9906cf0dec9e32094336d54529e8a8d8850e406723576d06c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9616999278564081664/index.html?e=69&leftOffset=0&topOffset=0&c=Ajrsu7eg41&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 08:49:58 GMT
x-content-type-options: nosniff
age: 28856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96332
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 15:09:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 08:49:58 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 4AE9 5 KB
5 KB 67ms
67ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=1149148716
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 06a1b5afc54f03b03f1ec1d55390a43b7d0bea926033263e0988e33a8db55d19

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:54 GMT
last-modified: Thu, 17 Jun 2021 11:09:56 GMT
server: Apache
accept-ranges: bytes
etag: "13e5-5c4f43f50991d"
content-length: 5093
content-type: application/javascript

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C9B0 17 KB
6 KB 144ms
143ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 16:50:54 GMT

GET
H3 200 ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js Show response
pagead2.googlesyndication.com/bg/ Frame 30B7 35 KB
13 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdeeaca456001a6797d1256ce2e3be59f8229174301f475c1e0b9a88b7fcb1ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 07:40:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33036
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13313
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 17 Jan 2023 07:40:18 GMT

GET
H/1.1 200
OK viewability Show response
hal900017.redintelligence.net/ Frame C695 0
150 B 179ms
59ms Script
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/viewability?s=77305900219363502179199011842017&a=6fef003e&vb=m
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900017.redintelligence.net/request_content.php?s=77305900219363502179199011842017&a=a970fd7b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:54 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame C695 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 68ms
67ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220112&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f470214d553d32f0fbcb8673b8cce2d7df62f8413bf60ccb26467293f7422bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 17 Jan 2022 16:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8707
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 150ms
150ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 16:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 17 Jan 2022 16:50:55 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 19B7 13 KB
5 KB 54ms
54ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 17 Jan 2022 16:46:45 GMT
expires: Tue, 17 Jan 2023 16:46:45 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 250
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A373 783 B
1 KB 182ms
64ms Document
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d32ea272c4efa290140f65c0ec6b8412b6b295d31c7a2f7ca8fc4d522cf89aee

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3sfl19/3ejQ7HjT9frVzbg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 17 Jan 2022 16:50:55 GMT
date: Mon, 17 Jan 2022 16:50:55 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-3sfl19/3ejQ7HjT9frVzbg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js Show response
pagead2.googlesyndication.com/bg/ Frame 19B7 35 KB
13 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ze6spFYAGmeX0SVs4uO-WfgikXQwH0dcHguaiLf8sa4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdeeaca456001a6797d1256ce2e3be59f8229174301f475c1e0b9a88b7fcb1ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 07:40:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33037
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13313
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 17 Jan 2023 07:40:18 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A6C3 42 B
64 B 87ms
87ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsveeGmLOkWj3zJ0q4jG9a9ADd7cS2-ddlXVtzTxhh4U_MOzeceWFL_6OGI3jxmFbFL1pDQ40qM2pc6UND5swbCVhQ&sig=Cg0ArKJSzCQ-40gAXpWZEAE&id=lidar2&mcvt=1008&p=0,0,90,728&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1731105763&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642438252997&rpt=1426&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B6C9 42 B
64 B 88ms
88ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssMNnvVCGAHESJnBLfUBliCnCX7igAOPst4zQyk7oCxaIPjQsEkqXEpsZzdkfbXJIcnsSUzlf7TJGh7bVUTvfbQg5bzHAm5ZYQR_ncLvgk0DSkOPm5GKg&sai=AMfl-YSS476m2CQibwdDtRN1JEp6262nDe9Rm40K3vcrTHw-Kak5M_32X-G6pahJecijYwSBMFF48K9hgtRE&sig=Cg0ArKJSzG8BLCAKMTRvEAE&cid=CAASBORoEiQ&id=lidar2&mcvt=1007&p=0,0,250,300&mtos=0,387,1007,1007,1007&tos=0,387,620,0,0&v=20220112&bin=7&avms=nio&bs=0,0&mc=0.97&if=1&app=0&itpl=20&adk=4224436493&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642438253019&rpt=1435&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900021.redintelligence.net/ Frame E1D6 0
150 B 177ms
60ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900021.redintelligence.net/viewability?s=23553600214937700951389011842021&a=b017299d&vb=v
Requested by: Host: hal900021.redintelligence.net
URL: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://hal900021.redintelligence.net/request_content.php?s=23553600214937700951389011842021&a=e0a65278
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 17 Jan 2022 16:50:55 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A373 0
0 91ms
91ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220112&jk=2193261437892792&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET generate_204
tpc.googlesyndication.com/ Frame 19B7 0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 91ms
90ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220112&jk=2193261437892792&bg=!OzilOHzNAAaocxMpqHM7ACkAdvg8WpAei056zTM_0YrD2s-1cAq4yxgiIVpZ-PDN6_P39ISpIvdNDAIAAACmUgAAAAJoAQeZAr9j94mfd4FDwPPGQfUdSZzJd0QiKdcUf_gR97VH0sorBz7kXrkXZgitRGIFOXSqN0upzX_PrKQkhWeRBKXbX8r2hfEXxt_JufO6EBLpBL4XD-l7TyTzrGzhIm2c499v-txzVA9CbmQ65CCwv2wNMM3ufpmnfl7TT2TIw8wayXC43SWn9vG2ASXu0pzNmW6CoKUx34bnGpZbTzPe91lOZi5zJjz7q00P_gAl6SotAhmtjWRBGvog8Fc2jePnSY55JuC11Czt-Tqi1oGXu_7zTwVBpPXlEDWd0EUYSq-4LyiWmSd68Y97C5c9hmE1rp--q1BxTrZtOoaouI3HKXxTWSYeF7G6mQ8hacsS3e24b-vmoafP-8iHNVzbknO1zs_8i93Qwea1g0k0RlAQn7nR7msBKuYvPh2DK6JKCSVF7DoXH7Jw8VCGaLt7y-Gu7gGWV1kBQpZt30JJnKyLMcQDTVU8H7BkC4U_k5L_9wwZJx_F4V4ro75mLHURkttyrb4sGri0B16f2oEFdRGUZYe-8sRDm_Vv7LWiwjXIhWX5Ncggj0IBoqc31Oci8O7JJasBC4z7zF7m9p3evpA5gPIqpEY-mqcezW2ck5PHq7f0qmZg1Nk0P0H7mMr5v47qcEPiHi45_IcynLcOnoCUqiz1MFMbXcTFXYRGYC_cPShJG5mJr454Z7pBGFYlI3NkM1UOv4JdDsmtWCBH1x-kLVZ6D6CC1SPILyT5K9ohtPvPqMmn_N6-XsJSRmgfhasYTIBIMlUBpHE4EKoLl0Z_bxoWki2uE3m-nfUmoEHtPcz2AuRidHEb7qcFpWmqW6jBRk0LUZTrnrfzmEk35SyOredkV-unjGNnFnP0N7jW58woLrNB-UkwFfCnDxvmVNXpGi4Ra_RdNGehQaQFfDNQSY22vZY5Ruw_1KKUWUIfjF6xf93M

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://gursesintour.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 17 Jan 2022 16:50:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/generate_204?WhCm1Q

Verdicts & Comments Add Verdict or Comment

201 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

27 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yadro.ru/	1970-01-20 08:58:22	Name: FTID Value: 1XvPvi38c3eF1XvPvi000108
.yadro.ru/	1970-01-20 08:58:22	Name: VID Value: 1K93Rm3xIGuF1XvPvi00019W
.gursesintour.com/	1970-01-20 17:45:10	Name: _ga Value: GA1.2.136266747.1642438253
.gursesintour.com/	1970-01-20 00:15:24	Name: _gid Value: GA1.2.33531349.1642438253
.gursesintour.com/	1970-01-20 00:13:58	Name: _gat_UA-59285794-1 Value: 1
prodmp.ru/	1970-01-20 02:23:34	Name: rai Value: 7ecbdf7ff78d747207f082f05ff5fc3a
.gursesintour.com/	1970-01-20 09:35:34	Name: __gads Value: ID=bf8914e897e12914-224c591622cd000e:T=1642438253:RT=1642438253:S=ALNI_MYEwAcqGW35QUZ_BKoIKUpDZF4Yng
.gursesintour.com/	1970-01-20 02:23:34	Name: _fbp Value: fb.1.1642438253371.291428934
dmpprof.com/	1970-01-20 10:13:58	Name: uid Value: e78683af-8981-4383-8b0d-599b60d624f1
.admixer.net/	1970-01-20 02:23:34	Name: am-uid Value: f7563efcfb614c5da416cf99d1b713e2
dmpprof.com/	1970-01-20 00:34:07	Name: enrich_data_v2_5 Value: 1642438253
.doubleclick.net/	1970-01-20 09:35:34	Name: IDE Value: AHWqTUlDn9zUfJpC97kRqgj6iA0WIV_W_d5eNZEBeRCEnRVq_AxRx7dbtrO1QNhV3yA
dprof.site/	1970-01-20 10:13:58	Name: uid Value: e78683af-8981-4383-8b0d-599b60d624f1
.mathtag.com/	1970-01-20 08:59:34	Name: uuid Value: 5e6161e5-9e6d-4001-8de8-3d977947ab54
.adnxs.com/	1970-01-20 02:23:34	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E?hpJ0_^!]tbPl1M>e)ZlrFUfJ+tGXxo<Yu9alMrtL>9#^]ACC3JfDCoO=Zsm'Qj/'eGbpRzqF1`b`8X34H<
.adnxs.com/	1970-01-20 02:23:34	Name: uuid2 Value: 4768156065479803842
.casalemedia.com/	1970-01-20 02:23:34	Name: CMPS Value: 1837
.casalemedia.com/	1970-01-20 00:15:24	Name: CMST Value: YeWebmHlnm4A
.casalemedia.com/	1970-01-20 08:59:34	Name: CMID Value: YeWebq.6EghFkusTSnzH7wAA
.casalemedia.com/	1970-01-20 02:23:34	Name: CMPRO Value: 1864
.casalemedia.com/	1970-01-20 08:59:34	Name: CMRUM3 Value: 2d61e59e6e2760CAESEO1hEUPgUmD4uWIuYMERDOA
.retailads.net/	1970-01-20 00:57:10	Name: ppb2172 Value: 1149148716
.awin1.com/	1970-01-20 00:24:03	Name: awpv14098 Value: 296283\|1642438254\|a2b79950-77b5-11ec-b837-2239dbd29a89
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 409715:2846681
.medialead.de/	1970-01-20 08:59:34	Name: trscj Value: MTY0MjQzODI1NHxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRNekJoTjJSbU9HUmxaR0UwWVdFMlAzTjFZbWxrUFRJek5UVXpOakF3TWpFME9UTTNOekF3T1RVeE16ZzVNREV4T0RReU1ESXhKblE5YUhSc2NBPT18YUhSMGNITTZMeTluYjI5bmJHVmhaSE11Wnk1a2IzVmliR1ZqYkdsamF5NXVaWFF2
.futalis.de/	1970-01-20 01:40:22	Name: raSIDb Value: 1149148716
pb.media01.eu/	1970-01-20 17:45:10	Name: DTU Value: 60E5FC8C11270294EC0F11B1786F50CA

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
ad-server.eu
admessage.support
adservice.google.com
adservice.google.de
ajax.googleapis.com
cdn.retailads.net
cm.g.doubleclick.net
connect.facebook.net
counter.yadro.ru
dmpprof.com
dprof.site
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
futalis.de
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gursesintour.com
hal9000.redintelligence.net
hal900017.redintelligence.net
hal900021.redintelligence.net
ib.adnxs.com
inv-nets.admixer.net
k0r2eokjm6.ru
m.trafmag.com
media.kaspersky.com
openfpcdn.io
pagead2.googlesyndication.com
partner.googleadservices.com
pb.media01.eu
pixel.mathtag.com
prodmp.ru
pv.medialead.de
pxksnymto.ru
rp-rep.net
s0.2mdn.net
secure.gravatar.com
stats.g.doubleclick.net
tags.mathtag.com
tpc.googlesyndication.com
www.awin1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
tpc.googlesyndication.com
104.111.239.217
13.32.99.33
138.201.84.252
142.250.185.162
142.250.186.130
144.76.238.55
145.239.193.130
146.0.227.110
159.69.70.9
167.233.14.134
172.217.18.102
185.29.132.242
185.33.220.100
185.85.15.23
193.106.93.124
193.200.65.6
2.18.233.201
2.18.234.21
2606:4700:3031::6815:1c44
2a00:1450:4001:801::2002
2a00:1450:4001:811::200a
2a00:1450:4001:827::2002
2a00:1450:4001:828::2001
2a00:1450:4001:829::2006
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2004
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::200a
2a00:1450:4001:831::2003
2a00:1450:400c:c06::9a
2a01:4f8:d0a:2321::2
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
5.9.195.152
54.76.176.197
67.207.77.125
85.192.12.170
85.192.12.173
88.198.250.30
88.212.201.216
010f9e05be3faa0246f4906f801bb039cd6572512ccee425125bfce4d6597c44
02338ec47d818b6f268f8d0608c0d738fb5db255f3050b17d7822993445919ed
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
06a1b5afc54f03b03f1ec1d55390a43b7d0bea926033263e0988e33a8db55d19
06b15ac88c3a03c088d5a13562dd3b7d70374172b44bc2b9fcd2a8c736ac7880
06d9487d0d05b38994c2a06ab9639cfa33afe0c98f89cbb0f3bcefb4cfb0aa84
0a71fcdbef44597ab39e930e1d4d6f19b516e0e8af8ad184aea52d41c81128fe
0a938256d2de59b044f8ca7c7aa0c788ed2ffa9a48bf0e3930a5830c4298f509
0ad770f7303d5654daf4d143d7b1b3bb746700bc1333497c9744f4f03ce42b91
0b871a763b8062ba855b553c95bddcc16a19fb8b00885db8dbb5c3d0978f6804
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0d1151458dc811f34103eab112c3e580ab1a0826ce7904c789a76e7e6fa6f6f9
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11b5ef79ac01ac3562dff2724e3400ddfc580e60248c22a5e1fef5189747e592
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
140c5c48ad466ec51a4e3bc79859abdc5541e88e074da94b4450c368eb07a58b
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
14469e457feb19f2deaeaa95bcf891e4c0f9251c7d7b231895564e0a0721861f
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
155791e15801f68c248ac66e85f4a1fb0273d5c156c3b28d28d11366bb75e9a3
165c8039d2cc8cf5f2e8420826bae213206286afc153811f8333dbec0015de34
17f18db89de2bf4b071bb5a1e645156b62eef2f165f0d72f13b912f1b57d2fbe
182daa52de7ef4ee43d02475134f9c75998afc13cc41b3e48bf1be7e77bced69
18726375d8f009a477f99d374efc7ce34f7fb4ede57a4c3e5891c8d4d464e3c5
197d58a862ea91422e76b59f3e2dde78b892ec7f1746ca6be666d016ebb6622e
1b7f4786a19f94a1c79b050735bd62209a8d1ed32dd7fa39c356b4786c472ace
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1cd6a2ddc706f3429b260970c5b9f6996b5fcefe28e4b7f879875d6ef79ee703
1cf1876f6c817c02d6cf92eee6fc76ef3b1e046e7b0b5cf73d549902dfdaf056
20b74de0626386609ecd0154d8f2bdbef356d55426b9cf7bf258da8ae9b7401d
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
2b0b59b03fe12cb15256a60698dd6d9c715ff28733b2bbe6b426d895db1e57b5
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
2d2ad11e3c1a0fd81bb085050d4b3170beab2964b5b848a5309a6343322e3898
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27
312b08336d3ddc49a6b02d12661743f683e4283dfcb292fe5d8118aea4dc5fb4
31abf7a15fd48a7c7f73864edd2fc9553a33dc27fa40759b5a6d2b78487924bf
328e4d28e98fb93cfa32d6fd8f3770e18492c9f8df76c32f0f9f3472fa7e276e
33f9d0917b2dac40e75a74cad23476ca18ba0c3127ae67c6ee6f6e3d850c2189
36e1166d91aa3f9906cf0dec9e32094336d54529e8a8d8850e406723576d06c4
37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
375b1733ee48b6f9b761b41476d76d92c5aa7c6065db11ce7a709e050cb39df3
38a712b18f92c87ae5d1b0899b14ed9cb0ccfc4f9dfdf5422ade73b57c42640b
3a8f53b52944c9cce626f7ac366ef29eae54dab9d4379e1319323fd76a5de7dc
3f470214d553d32f0fbcb8673b8cce2d7df62f8413bf60ccb26467293f7422bf
3f661b408ea4744a2ce766d66caaa3f6e2e794f1555cee78d1c0afdb56a55907
413f46b30a937d320b50d51e5fccf47e47a4dac30b3aa3de568dbb19f0f7c9b9
425b48211e0ebe795b6ead9ec2f1bcd9e04e9930a7dd30e08cdb2fef0bcb834c
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45b9cb36b814acbe935b2bb6359df41765dabdeec2fc2fe034357d03d395110a
45e0931c4fdc7533cfa9a120038b42db5c9c366fcbabbd89acd84f001ab29490
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
4693f068f338a05cf90e7a9be3d4754cf7303411a9503e1a08f9ea37db30ff19
4735133711335860e73767635c24ee650632154a838c09ddb1595c5184f11682
4884b638135815cdcdd22b9e6e82d6b5cc31f3c7e338beadc9b57ebab17a3e82
489665aba7eee480b6b43a874675f73ba81cc3a7ef9b6c8bc893319812177efb
48e3f53a83b8699bb168a12bfa50430fc461687ca9a93bcf757eb35877adfd4f
4a13ccb1992e423065f7bef88f57f171e746d53cd96cdb51dd13decc8c532678
4a65567f19e8e78b56336e6e61fe45d55840fdf2b7c0a5e1ca076c3a15af3c3b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52b0afa372af7cfa3af9e5d58e3f75fe7a1ff812b5ee43df275aeba3579a693d
53b907326f7c21a04f6d39cc32ff471aafec57d887feabfabb53394f378c659f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5722dab9d2cbd31ed9153180623c7ec69e4b65fd7a213e2b0fa4be3a450335c2
582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd
5b56f14bb63fc412aec1562ff5b4807919a486491f2e9a86054ef08922c634d1
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c3558189249bedee1672dafd3e00f5ff530e4f0379cbde217cd869ca8756058
5cbaa50905cbfd614dc889e6155550145a3ed92a0085f7cbfcdd5df69145dfdf
5ec72ee4f704bfdea70d2ea0471b7629cced6708346b7783f3a0ef0ad43f027a
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6727fe51144ebae36253d177d933281a75f2589461cedf11fb64ca1a4848e86d
6a623062bbb8f8e98f0b6d0cef42991661dd6eb36afcc8e08c2eef645eaf7d37
6ac5faf060aa72af0983e581db842eef1c2072b5fdb58c026fe678e457651ff3
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d2a2b7e44c01d1513799e41a1a060ac89160a54b8a57b6cc6d2f4ed0b7ed6ff
6e8b46d9219a1d55e71c59dd2128bba7983150c48d08ed75124fa74e2d792992
6ea7b59b49b628792395b8ae59e9f257b5343142b8cc439e31ba42124abea863
71348f4f38512af6e6ba8062fe5545a783f91d1a07bcb300c246f1bad9b0d4b6
73a5b3d9d1565b6c1438737a696c511ec44092f335856f92b5b896d44dbacd90
7b5a664070ab4b7a103220a5029d6d8d4101105cae1fead97f1d73f5c7741492
7dc250a9c098fe83e9ae4f0313c3238c18fd17a971e00d36812441f9e4ce98f8
808d1f65aba5749919ce232a57a7873a94057a96dd1abb5912a07190a79b551b
83a9ab434109bc8045cf6ccdd0365b0e53b6acf155438de7370ce67fd0facc79
83c5b3e53fd69cf862fcdfd34a06fe7cc0fb26072235b1966fa02caae3a43eb7
8460aaf36b73e229c6b0fcaf7bac791e23c3145e87de6a04d0d91541e39289b6
887cb3ce7da176b5a0f52cfa39c478da29022e630db641b2d3178b022a37ced3
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
894e24bf7cd3383660a98e70f31d2ea56c65555281a378d247640320cb7567d8
8bb03ea2b79c17ecd939b74449a322f9f70d98587347c91467f4d03c4963ccfe
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
8f7b33522a80d7c38f394351ff9d2981ef631714f43658f9d2edc13804150d53
909730eff2cb5a0550fe7842076dde4ee015d5719ea1ac4553374279f16666cf
92bab1b3797ce5864ebf34ac10727256e8f0a243a1d7c8cca72054efdd38a538
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
93c5074560c4c64e70bd3f89e9cf27bcab97210f3dad0019afe6af050bbd69a9
94264e80d02aee478cab597737b2e4defdb90659167ceb87e82543494b98d9f0
9563fdc19456cd77d4a8726af68cd4909cc4031208bc2eecda0a75942deec403
962bba463fbc870e1d4e8a32dd01bf0d86af35502a83838f5224b138764e6911
9a8fb669ba6cb6f0f90aa2091e09326c460d6541400cebc18b8057d0b955b5fd
9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f
9fd72153ba3e8a36d7e6a93d9bd5acb61f8f1cde905b95955a10761aa7e3636d
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a34e559739213b9e80ecd2c0c1c7d93bd3c08fcd90829d652853478f658b203b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76
a5130a2e12db1d4c160e0db44c12ec2404d451a7ed5ffd1da2627e8c72bfe14f
a5b8cd861e14c0534e35b254d7c5b052407781c08ba39cb9b12a3eb9cfe355c2
a665b3ad14cb2075a396c2c542ea83c928fbcfb08160330bdec73177c63cc97e
aa8ab2153beec5132d9268e321035fbee7f935ddcf90294ceb3424f7fe3e5405
aaab41ab2c6f5e4cce9ad326a3893d03168c5e0d3cd9798f0854b1be8ca8f684
ac2ce0efc5a65861e27b78c6462d76fec331090913aa7fe4418d757684cbe3f6
ac9ea1fd0fd23c2e48ce098da486d4168fa954f9a13585628c63e0958ebab977
ae68b729dc67726d8cc7649f1e32bfd7623a098753d96bcff6562b1256843809
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b170c8fbe1bf2f0ce0ff63b0da20b8eed70edd68c7fb73ac41aecd2f90d75d99
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b29083ee81935db712459c36e5d1a2088c3b635f0b531e286febbc293a235a15
b3d3adde72232ced1d0afeb03403c8e9368519bfe3e69469be888802ff4bb12b
b6d30c7e11f051f84febcc8a5ed1d174c68338a36ace4736593d542a9bdeed5f
b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477
bfe13e2a23ad343324757b45fb29919a5d2d8a32ad5504e1e317116f1a577a23
c08152bb0e82623406aca0618b1e30d4b5b313f6bbc2485e737dc6d61ed7d1fc
c42425f18923921089911e70f39c6dd462794df2e42ac0596abc3884da6471fc
c56b566e17c62870ce139b3a57bfb94a9d785792bd6ac2220d52426b8590d87f
c715a68bf204c3ab22940831dc8c7f4b7264f7791944125f7c90a5975bac608b
c76e22f55ca0ef562872870940dc4dd2986c6b0c99f6a2c72978181f70406cf6
c867104326e3c4b658209d8e5bcea0900aaf7fbc2bbc181ca01c482cac2810f3
ca2fe0f124bddbb5d80ac8a219b748eb6511713ee291d271d7d7d71f184a0e59
caf81c9196bab5349753b814f7ecba01fda07f18d2ced30df0199057e513655b
cbd0baa7584d58cb232c958aa33a527868ccaa7d5d1404cd149824b878bea6ec
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cdeeaca456001a6797d1256ce2e3be59f8229174301f475c1e0b9a88b7fcb1ae
d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d32ea272c4efa290140f65c0ec6b8412b6b295d31c7a2f7ca8fc4d522cf89aee
d35df0cddd350fa02da8b7023894755150e758da14af45d5d4b8a7d90799d404
d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3
d78a8bf4354c9a218e8a513f3ea7ac2a3558f453b4e5c6e6edbbc6adeb0f4fea
daa74847c5bb4dc763a55e007ab49f84bfa8793fed4d2ffed0aa571d1b1c8edd
dc40519e22545b5835214128bd107a8304e66096bf086b37e326a3659bf3711e
dcd4faf4bf75b6401f61eef5b9434a327ab8a187c0b429ea533d2faa8d8d78a5
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1f80f474e4aef3be91ef7c340358092dd8cfb6995fb47ebc9594f25dbcfaddf
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
e321098f4c6ffe0dc55e4b925d7b162bc04ab062fa8247ac62d36ffe8c3617fa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e8644cfe5394b9cff4dd9dad2f3e5cbff31338aeb61beb7c32c886f0462ccb7f
eaec5f0d1a81fb864cc6cdc2fcc24495d25bc5430eeb906c79289a4caa576b38
ebc5d9fa5cf83cb90bd8f6f809e5bffdbecb8b4a8c408f522093e52c91aa0651
ede502472fff2aee0407620358471c77f19f4788af00830c4d6c4b4ae56f3f4c
eecd4a4d074a4ba40515b99c3b5638dfe23c1272896f3c5c2a732f882a9c12d5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f17086e2aabf6767e7f89afa09bcecd3926b3635f3d9d47f87d50f574db7b6fe
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23
f6eef1e4f7a4116aa27af75d78ae566a6e8c986c16a09302e3b4ccb4441564aa
f77676010af045f74f15412f1ca9b418478066304101556281c5b4e162932525
f79c91ecc9669b069ab963959ddea67069bec8d65f85f6f2d2aee1b53a23b3fd
f970fce7da65c57fe5f33fa461ea5fe6e76ff129d68d537ee7d54625aa05cd26
f9962dc81702799822919e862a8a09b9e55950e39c47c8b28345e21db2586648
fcbd587432f5e88fc926d1cde0d375084b7f3e711f9ff34571dec52f70fb27cf

gursesintour.com Open in urlscan Pro 5.9.195.152 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

203 Requests

95 %HTTPS

42 %IPv6

37 Domains

47 Subdomains

42 IPs

10 Countries

2804 kBTransfer

8048 kBSize

27 Cookies

1 Outgoing links

Page URL History

Redirected requests

203 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

gursesintour.com Open in urlscan Pro
5.9.195.152 Public Scan

Screenshot
Live screenshot

Full Image

203
Requests

95 %
HTTPS

42 %
IPv6

37
Domains

47
Subdomains

42
IPs

10
Countries

2804 kB
Transfer

8048 kB
Size

27
Cookies

203 HTTP transactions
7 data transactions