www.winscreen.ru Open in urlscan Pro
176.9.19.123 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.winscreen.ru/
Submission: On February 08 via manual (February 8th 2022, 1:55:08 pm UTC) from EE — Scanned from DE

Summary HTTP 138 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 24 IPs in 5 countries across 17 domains to perform 138 HTTP transactions. The main IP is 176.9.19.123, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.winscreen.ru.

This is the only time www.winscreen.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
37	176.9.19.123 176.9.19.123	24940 (HETZNER-AS) (HETZNER-AS)
11	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2 3	88.212.201.210 88.212.201.210	39134 (UNITEDNET) (UNITEDNET)
4 8	2a02:6b8::1:119 2a02:6b8::1:119	208722 (YNDX) (YNDX)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638::18 2a02:2638::18	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:206... 2600:9000:206f:2a00:1e:a43d:b640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	178.250.0.160 178.250.0.160	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
9	178.250.2.135 178.250.2.135	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
138	24

37 176.9.19.123 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.123.19.9.176.clients.your-server.de

www.winscreen.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.ruprograms.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 88.212.201.210 (Russian Federation) 2 redirects

ASN39134 (UNITEDNET, RU)
PTR: host210.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN208722 (YNDX, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::18 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:2a00:1e:a43d:b640:93a1 (United States)

ASN16509 (AMAZON-02, US)

secure-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.160 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 178.250.2.135 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.am5.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	winscreen.ru www.winscreen.ru	772 KB
31	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 100 tpc.googlesyndication.com — Cisco Umbrella Rank: 124	411 KB
17	criteo.net static.criteo.net — Cisco Umbrella Rank: 645 pix.eu.criteo.net — Cisco Umbrella Rank: 7730 csm.eu.criteo.net — Cisco Umbrella Rank: 7881	36 KB
13	gstatic.com fonts.gstatic.com www.gstatic.com	243 KB
12	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 46 stats.g.doubleclick.net — Cisco Umbrella Rank: 96	117 KB
5	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 13 adservice.google.com — Cisco Umbrella Rank: 80	2 KB
5	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 25627	2 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	5 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 165	151 KB
3	criteo.com rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 13370 ads.eu.criteo.com — Cisco Umbrella Rank: 7925 cat.fr.eu.criteo.com — Cisco Umbrella Rank: 10834	58 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5557 adservice.google.de — Cisco Umbrella Rank: 8028	1 KB
3	yandex.ru 2 redirects mc.yandex.ru — Cisco Umbrella Rank: 2853	49 KB
3	yadro.ru 2 redirects counter.yadro.ru — Cisco Umbrella Rank: 8294	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	20 KB
1	imrworldwide.com secure-gl.imrworldwide.com — Cisco Umbrella Rank: 1576	460 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 777	646 B
1	ruprograms.ru www.ruprograms.ru	671 B
138	17

	Domain	Requested by
36	www.winscreen.ru	www.winscreen.ru
20	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.winscreen.ru
11	pagead2.googlesyndication.com	www.winscreen.ru pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
9	pix.eu.criteo.net	ads.eu.criteo.com
9	fonts.gstatic.com	fonts.googleapis.com
7	static.criteo.net	ads.eu.criteo.com
5	mc.yandex.com	2 redirects www.winscreen.ru
5	fonts.googleapis.com	www.winscreen.ru googleads.g.doubleclick.net
4	www.gstatic.com	googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net
3	www.google.com	1 redirects www.winscreen.ru tpc.googlesyndication.com
3	mc.yandex.ru	2 redirects www.winscreen.ru
3	counter.yadro.ru	2 redirects www.winscreen.ru
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google-analytics.com	www.winscreen.ru www.google-analytics.com
1	csm.eu.criteo.net	ads.eu.criteo.com
1	cat.fr.eu.criteo.com	ads.eu.criteo.com
1	secure-gl.imrworldwide.com	ads.eu.criteo.com
1	ads.eu.criteo.com	googleads.g.doubleclick.net
1	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google.de	www.winscreen.ru
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.ruprograms.ru	www.winscreen.ru
138	26

This site contains links to these domains. Also see Links.

Domain
www.liveinternet.ru
vk.com

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-12-22` - `2022-06-03`	5 months	crt.sh
www.google.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-06`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-10`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-02` - `2022-05-03`	3 months	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-04` - `2023-02-03`	a year	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-09` - `2022-04-04`	3 months	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-03` - `2022-05-02`	3 months	crt.sh

This page contains 15 frames:

Primary Page: http://www.winscreen.ru/
Frame ID: 4E82291C4FF84E966EDE96C6E79EF628
Requests: 66 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20190131/zrt_lookup.html
Frame ID: 7DCED17DCA23908988EB11E6BE66666C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&adk=1812271804&adf=3025194257&lmt=1644328503&plat=3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.winscreen.ru%2F&ea=0&flash=0&pra=5&wgl=1&dt=1644328503466&bpp=2&bdt=290&idt=250&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4789806377679&frm=20&pv=2&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=263
Frame ID: 3F08A39F12A0915A503043DC03E86E86
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=3758274007&adk=2455135674&adf=2780431300&pi=t.ma~as.3758274007&w=336&lmt=1644328503&psa=0&format=336x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&wgl=1&dt=1644328503468&bpp=1&bdt=293&idt=266&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=642&ady=1185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=9ivGzPJqor&p=http%3A//www.winscreen.ru&dtd=271
Frame ID: C07F1AEEB056701DD4F378265132DAB3
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=7130542809&adk=584184861&adf=1706824535&pi=t.ma~as.7130542809&w=1158&fwrn=4&fwrnh=100&lmt=1644328503&rafmt=1&psa=0&format=1158x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1644328503469&bpp=2&bdt=293&idt=272&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=221&ady=1598&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=6tVQ3nYNnZ&p=http%3A//www.winscreen.ru&dtd=275
Frame ID: 4295DAD269C841545C6E2AD0DEF068FC
Requests: 7 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YgJ2NwAMrwgKGU0HAAUTkf97aDfkUda9UD3LUQ&u=%7Cu11yF5CJ%2FO1PoFrqMz6JbXtdPfj12nKJ0m7%2FLPq5JZY%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy1B5BQQR8kQeJwdGNspOzMyGgUjSRvIlPUgkKp68amMVmQjxCirFEcNAXP16rI4BJguurh-7vkkUZKa8cSeyHa4jKQuO5hw49Tej7Pov_JkUTAxk6MFRyqeeROR2HE1U2o83ueu5Q2Q9uXVoqfoPDIhN10hTVfYzM93-59-sGsIZTd9xXgzPU8B44jIZeIS09ZybBlpLguOeqmWABU95gGatZ0PNmcW16fhibe1BEM0kztNDIRCb9Nk5G6B9E-7bQyUDzjwPJpGatfgi-JbA3vsGlZ5jDA6RR5RRfGEePjUZLRzpWVgA0YudQwtMXOr1u7dhggJoKwI5JNPWBfX4FrIJwxqWPlrh6xGfkOWcRnOQqlVZCjMB0r8gZDvTMtOIWRX0sNpLbfsR&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVbURN3YCYojeMoeaZZGnlMACyZ7SsVyVyZT3cMCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yMzQxNzY3NjE2MDk4MDU1oAHVttLqA8gBCakCzuB3kLwisz6oAwGqBL8BT9Ck2NliDDk--Ik9WlaxJNnemD52HLxXuSzsmikiobZ9KUH3HLKrMvKwM5Hzzvpt3dW3niFLIFRlaII5USYjjZk_Y90M2vFW9TzfAi_zT-vUjoyk1uieYZT601GscoSS5nXZ9x9pVephVSLrvhm5M8RmBzwrWCygHUu3BLrB5CvVLgymnq081mHtJ8ANUM2fqGvr7rm0uW1g7W6KRMeSK0vcfl1HM29RJKJSmxyg986g5EGjSJoU3GXwZMbuOHKABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2LbvQ2ekwmaFJn_n_7N8KUk3dk3Q%26client%3Dca-pub-2341767616098055%26adurl%3D
Frame ID: 04474C5ED68887032A6D4551744B1060
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1
Frame ID: D80A52291E273A20C49D48A2A9508E0C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1
Frame ID: C702E9D4A16649E8983EC31FED994774
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js
Frame ID: 4B3282927888CB80834A8ED3A90609A9
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 1E23613F4B70001DF6AB7A848259546C
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 87F54768C4F202D56F747EE3446E8464
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js
Frame ID: 4BC2952EB208122EB01A04970097247D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js
Frame ID: A36CAF535D907A3AECBC39329059F8F8
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D58EDBB2A205C15B4CFC4E76D06D2D5E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8BD02BAEB1014E89A3DB9A443333C7DC
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WinScreen — всё для оформления Windows 10

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

138
Requests

63 %
HTTPS

74 %
IPv6

17
Domains

26
Subdomains

24
IPs

5
Countries

1869 kB
Transfer

3355 kB
Size

20
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://www.liveinternet.ru/click

Search URL Search Domain Scan URL

URL: https://vk.com/winscreen
Title: ВКонтакте

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

http://counter.yadro.ru/hit?t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607 HTTP 302
https://counter.yadro.ru/hit?t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607 HTTP 302
https://counter.yadro.ru/hit?q;t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607

Request Chain 38

http://mc.yandex.ru/metrika/watch.js HTTP 302
https://mc.yandex.ru/metrika/watch.js

Request Chain 39

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 52

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9543.4OJ1q9iVvKiDd0N18bMQL0StTOEWDeY5SO8P6ZrqejOit7rSpDedx_jEAmupC6sy.smIKH_g3JwEFa4vtswyFUCEmoXI%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9543.JJCaY11Mcp8y6Uh-2hLCS67WhB2pKqKGQq8KyWVSzTZYJ3oITg0ucgFXzU1Y4AGfSezdbAV8BvqhU-c1lp4MOQ%2C%2C.GeP96P6NX7EasBTKqkxNj2E8too%2C

Request Chain 62

https://mc.yandex.com/watch/30260682?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A751%3Acn%3A1%3Adp%3A0%3Als%3A462387153687%3Ahid%3A627664240%3Az%3A0%3Ai%3A20220208135503%3Aet%3A1644328504%3Ac%3A1%3Arn%3A713918268%3Arqn%3A1%3Au%3A1644328504965726956%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Antf%3A1%3Ans%3A1644328502899%3Ads%3A211%2C10%2C52%2C11%2C0%2C0%2C%2C205%2C8%2C%2C%2C%2C490%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1644328504%3At%3AWinScreen%20%E2%80%94%20%D0%B2%D1%81%D1%91%20%D0%B4%D0%BB%D1%8F%20%D0%BE%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20Windows%2010&t=gdpr(14)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/30260682/1?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A751%3Acn%3A1%3Adp%3A0%3Als%3A462387153687%3Ahid%3A627664240%3Az%3A0%3Ai%3A20220208135503%3Aet%3A1644328504%3Ac%3A1%3Arn%3A713918268%3Arqn%3A1%3Au%3A1644328504965726956%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Antf%3A1%3Ans%3A1644328502899%3Ads%3A211%2C10%2C52%2C11%2C0%2C0%2C%2C205%2C8%2C%2C%2C%2C490%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1644328504%3At%3AWinScreen%20%E2%80%94%20%D0%B2%D1%81%D1%91%20%D0%B4%D0%BB%D1%8F%20%D0%BE%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20Windows%2010&t=gdpr%2814%29aw%281%29ti%282%29

Request Chain 129

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

138 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.winscreen.ru/ 22 KB
23 KB 273ms
52ms Document
text/html 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 / PHP/5.4.45
Resource Hash: 22ff85ccf23206b6dfcfae06cd9451599b9cab04913526500a95d5be710efa7e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx/1.6.2
Date: Tue, 08 Feb 2022 13:55:03 GMT
Content-Type: text/html; charset=cp1251
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache

GET
H/1.1 200
OK jquery.js Show response
www.winscreen.ru/engine/classes/js/ 94 KB
94 KB 11ms
11ms Script
application/javascript 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/engine/classes/js/jquery.js
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 11:53:01 GMT
Server: nginx/1.6.2
ETag: "5530f41d-176bb"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 95931

GET
H/1.1 200
OK jqueryui.js Show response
www.winscreen.ru/engine/classes/js/ 91 KB
91 KB 43ms
11ms Script
application/javascript 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/engine/classes/js/jqueryui.js
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 43a47caa5313298982be56a0ccd530a083d130260b2b6dfe21f5ec3827c09684

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 11:53:01 GMT
Server: nginx/1.6.2
ETag: "5530f41d-16b15"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 92949

GET
H/1.1 200
OK dle_js.js Show response
www.winscreen.ru/engine/classes/js/ 24 KB
25 KB 43ms
11ms Script
application/javascript 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/engine/classes/js/dle_js.js
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 170531dc856e5aece4c3a0b4b8a7885fd2773b5e19eca5d8ed17fde3cc55f0ca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 11:53:01 GMT
Server: nginx/1.6.2
ETag: "5530f41d-6128"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24872

GET
H/1.1 200
OK engine.css
www.winscreen.ru/templates/winscreen/style/ 31 KB
32 KB 21ms
11ms Stylesheet
text/css 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/style/engine.css
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: e944f656b030f2f0bdf64fd79635fb0669c1097844e6108c25cb30b328e269cc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 23 Apr 2015 18:52:48 GMT
Server: nginx/1.6.2
ETag: "55393f80-7d81"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32129

GET
H/1.1 200
OK bootstrap.min.css
www.winscreen.ru/templates/winscreen/style/ 115 KB
115 KB 21ms
11ms Stylesheet
text/css 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/style/bootstrap.min.css
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 49312df390f78c111bf7ddaf6a244e26cce429f7551b9d3fa4e742ce784dc871

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 23 Apr 2015 12:39:46 GMT
Server: nginx/1.6.2
ETag: "5538e812-1ca3a"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 117306

GET
H/1.1 200
OK bootstrap-theme.min.css
www.winscreen.ru/templates/winscreen/style/ 19 KB
20 KB 21ms
11ms Stylesheet
text/css 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/style/bootstrap-theme.min.css
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:13:13 GMT
Server: nginx/1.6.2
ETag: "553106e9-4dfb"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19963

GET
H/1.1 200
OK social-likes_birman.css
www.winscreen.ru/templates/winscreen/style/ 13 KB
14 KB 22ms
11ms Stylesheet
text/css 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/style/social-likes_birman.css
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: a219f9ac5cef7642ed890175e859fa245c5f599e10e01aa6f62d957a4f48067c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 23 Apr 2015 13:59:51 GMT
Server: nginx/1.6.2
ETag: "5538fad7-35bb"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13755

GET
H/1.1 200
OK bootstrap.min.js Show response
www.winscreen.ru/templates/winscreen/js/ 35 KB
35 KB 43ms
11ms Script
application/javascript 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/js/bootstrap.min.js
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:13:35 GMT
Server: nginx/1.6.2
ETag: "553106ff-8c6f"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35951

GET
H/1.1 200
OK libs.js Show response
www.winscreen.ru/templates/winscreen/js/ 1 KB
1 KB 52ms
11ms Script
application/javascript 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/js/libs.js
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 92dbcaa9ac6393304ed5554e85ebedbad2e9eb71cef1fb725175940316aefa38

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 23 Apr 2015 17:14:08 GMT
Server: nginx/1.6.2
ETag: "55392860-4ba"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1210

GET
H/1.1 200
OK main.css
www.winscreen.ru/templates/winscreen/style/ 46 KB
46 KB 21ms
11ms Stylesheet
text/css 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: dc1e0c7f43c00eeef5863bfad474088c33f2009822a6680731577298aaf69639

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Mon, 24 Sep 2018 07:35:27 GMT
Server: nginx/1.6.2
ETag: "5ba893bf-b669"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 46697

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
53 KB 104ms
60ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

HTTP/1.1

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93b8363f283fb6ce1fc8e94d54d3984cf7992f3902468b343c64fd7ed6d03963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Tue, 08 Feb 2022 13:55:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 4182632222744950025
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 53653
X-XSS-Protection: 0
Expires: Tue, 08 Feb 2022 13:55:03 GMT

GET
H/1.1 200
OK logo2.jpg
www.winscreen.ru/templates/winscreen/images/ 2 KB
2 KB 11ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/logo2.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 755c45ebe08b9d47f5f59e41a2ffe4094480836090b75cc106ef59d75818150e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-739"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1849

GET
H/1.1 200
OK logo4.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
2 KB 11ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/logo4.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 293b060eec862be1b59597dce4539862df949e5d7af849efbe4cabddb4ab33ec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-56a"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1386

GET
H/1.1 200
OK 1614188260_dee0pai-0cbada22-67a5-427e-8e66-8f65951e5be7.jpg
www.winscreen.ru/uploads/posts/2021-02/medium/ 80 KB
80 KB 12ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2021-02/medium/1614188260_dee0pai-0cbada22-67a5-427e-8e66-8f65951e5be7.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 3cbd9dcd567cfc3c97fc13b97b9e05b8acd797212376bdc2711f9c0c993dee59

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Wed, 24 Feb 2021 17:36:29 GMT
Server: nginx/1.6.2
ETag: "60368e9d-13e5e"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 81502

GET
H/1.1 200
OK 1610468707_snimok-ekrana-2021-01-12-192343.png
www.winscreen.ru/uploads/posts/2021-01/thumbs/ 7 KB
7 KB 12ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2021-01/thumbs/1610468707_snimok-ekrana-2021-01-12-192343.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 2553455ddf15cb2dd26ae9c776156c14cd4d30de5a9ba79f586916dd69f220f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Tue, 12 Jan 2021 16:23:57 GMT
Server: nginx/1.6.2
ETag: "5ffdcd1d-1b8e"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7054

GET
H/1.1 200
OK 1605024042_001_de7t5ds-9e943e36-fd84-49d1-b24f-fc03638f88df.jpg
www.winscreen.ru/uploads/posts/2020-11/thumbs/ 9 KB
9 KB 12ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2020-11/thumbs/1605024042_001_de7t5ds-9e943e36-fd84-49d1-b24f-fc03638f88df.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: c8afc467191f63438c455e719dc800d90593dfee1a860e05118cb569554d7cea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Tue, 10 Nov 2020 15:59:55 GMT
Server: nginx/1.6.2
ETag: "5faab8fb-2235"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8757

GET
H/1.1 200
OK 1571412477_ddhzx1c-063973c8-e064-45c9-ab8c-c0d70bc12cef.png
www.winscreen.ru/uploads/posts/2019-10/thumbs/ 56 KB
56 KB 12ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2019-10/thumbs/1571412477_ddhzx1c-063973c8-e064-45c9-ab8c-c0d70bc12cef.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 583f8b753da4971a5e70b7ceb8aa498aaefec0665d10078685cba8767a6705c7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 18 Oct 2019 15:27:24 GMT
Server: nginx/1.6.2
ETag: "5da9d9dc-e0b4"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 57524

GET
H/1.1 200
OK 1603265256_snimok-ekrana-2020-10-21-102208.png
www.winscreen.ru/uploads/posts/2020-10/thumbs/ 26 KB
27 KB 12ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2020-10/thumbs/1603265256_snimok-ekrana-2020-10-21-102208.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 3a149fbe4e85e25b086e886e18f24a7cf389d7b2f35e29c81d2025a953a5e13e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Wed, 21 Oct 2020 07:26:58 GMT
Server: nginx/1.6.2
ETag: "5f8fe2c2-6986"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27014

GET
H/1.1 200
OK 1602137294_rebirth_v02_5120x2880.jpg
www.winscreen.ru/uploads/posts/2020-10/thumbs/ 5 KB
5 KB 11ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2020-10/thumbs/1602137294_rebirth_v02_5120x2880.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: c9849d1ff47146923bbe3318382f2d203817768ff1384d2ba05e734bab537c6f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 08 Oct 2020 06:06:53 GMT
Server: nginx/1.6.2
ETag: "5f7eac7d-147c"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5244

GET
H/1.1 200
OK book.png
www.winscreen.ru/templates/winscreen/images/ 771 B
1008 B 11ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/book.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 430a717aeb541812e12e5144ca5a95887c42544a9ea89ae3a075442887256605

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-303"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 771

GET
H/1.1 200
OK 1555566079_annotaciya-2019-04-18-083648.jpg
www.winscreen.ru/uploads/posts/2019-04/thumbs/ 10 KB
10 KB 11ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2019-04/thumbs/1555566079_annotaciya-2019-04-18-083648.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 3a21fedf569cccca5db2f403084504ec5f68356c37615a21963f24908b2bbc0b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 18 Apr 2019 05:41:04 GMT
Server: nginx/1.6.2
ETag: "5cb80df0-27e3"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10211

GET
H/1.1 200
OK 1555494587_000_snimok-ekrana-1.jpg
www.winscreen.ru/uploads/posts/2019-04/thumbs/ 9 KB
9 KB 12ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2019-04/thumbs/1555494587_000_snimok-ekrana-1.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 2ee9acfeecd92aaa4867bec606dfc4ac890f4d15cafa7754372d5a88ee8db484

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Wed, 17 Apr 2019 09:49:16 GMT
Server: nginx/1.6.2
ETag: "5cb6f69c-2469"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9321

GET
H/1.1 200
OK 1537425732_image-11537424629.jpg
www.winscreen.ru/uploads/posts/2018-09/thumbs/ 11 KB
11 KB 11ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2018-09/thumbs/1537425732_image-11537424629.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: f4ae648d8e8f48b124ee62511e7765fbfa9057a2a6f7efa36230ecaae743bfb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Thu, 20 Sep 2018 06:40:35 GMT
Server: nginx/1.6.2
ETag: "5ba340e3-2ac7"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10951

GET
H/1.1 200
OK 1533120494_image-2101247.png
www.winscreen.ru/uploads/posts/2018-08/thumbs/ 29 KB
29 KB 12ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/uploads/posts/2018-08/thumbs/1533120494_image-2101247.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 50c3949ea00c37ee90caee3d251b25c5dd6b0cd7a8994b10724cb63aee53e0f5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Wed, 01 Aug 2018 10:47:12 GMT
Server: nginx/1.6.2
ETag: "5b618fb0-7293"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29331

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 85ms
47ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic-ext

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2796b7ead0b341319893789b7ee0a01cf0df9d2076947def19c70cf1ed5853e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Tue, 08 Feb 2022 13:55:03 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Tue, 08 Feb 2022 13:55:03 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 86ms
48ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Roboto+Slab:700&subset=latin,cyrillic-ext

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

77893ad689369fc3fa0974092849ec516efb9916e3fed4aa96f568c377679768

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Tue, 08 Feb 2022 13:55:03 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Tue, 08 Feb 2022 13:55:03 GMT

GET
H/1.1 200
OK bodybg.jpg
www.winscreen.ru/templates/winscreen/images/ 356 B
594 B 14ms
10ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/bodybg.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 54d763b7b3f17e0c25f1bc24d729ce074d6260d6b8a5184cc21912a6c82ca90a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-164"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 356

GET
H/1.1 200
OK searchbtn.jpg
www.winscreen.ru/templates/winscreen/images/ 888 B
1 KB 16ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/searchbtn.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: cbdf60e7ec3077e956fdcc9ed23d21a23289b3af89ac2871cd7fd1ec598a5c46

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-378"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 888

GET
H/1.1 200
OK bgtrans.png
www.winscreen.ru/templates/winscreen/images/ 212 B
448 B 15ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/bgtrans.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 8dd863a9399e6391b0a28cc931d88845d2b0ccd7f6eedf982f56c038ad2e4d9d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-d4"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 212

GET
H/1.1 200
OK bgtrans2.png
www.winscreen.ru/templates/winscreen/images/ 229 B
465 B 15ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/bgtrans2.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 82e6e04cd8c38adb585a20e2ae8eb9f33db5de67c025188ef2ec0631f55c5156

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-e5"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 229

GET
H/1.1 200
OK jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v16/ 46 KB
47 KB 73ms
37ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v16/jizfRExUiTo99u79B_mh0O6tLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 02 Feb 2022 20:12:24 GMT
X-Content-Type-Options: nosniff
Age: 495759
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 47048
X-XSS-Protection: 0
Last-Modified: Wed, 26 Jan 2022 18:57:46 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Thu, 02 Feb 2023 20:12:24 GMT

GET
H/1.1 200
OK jizaRExUiTo99u79D0aExdGM.woff2
fonts.gstatic.com/s/ptsans/v16/ 28 KB
29 KB 78ms
40ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v16/jizaRExUiTo99u79D0aExdGM.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e9c22d02fc319b701844b334477a05fd32acee9668feb98672f6c27887f79cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 02 Feb 2022 20:24:43 GMT
X-Content-Type-Options: nosniff
Age: 495020
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 28444
X-XSS-Protection: 0
Last-Modified: Wed, 26 Jan 2022 18:57:54 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Thu, 02 Feb 2023 20:24:43 GMT

GET
H/1.1 200
OK BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2Rj.woff2
fonts.gstatic.com/s/robotoslab/v22/ 12 KB
13 KB 78ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/robotoslab/v22/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2Rj.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Roboto+Slab:700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ee2c2fb62c3ff276b5e38b325b44c26becb66331c106d05dbf27b12ee22c3d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 03 Feb 2022 10:02:25 GMT
X-Content-Type-Options: nosniff
Age: 445958
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 12792
X-XSS-Protection: 0
Last-Modified: Thu, 03 Feb 2022 00:13:57 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Fri, 03 Feb 2023 10:02:25 GMT

GET
H/1.1 200
OK glyphicons-halflings-regular.woff2
www.winscreen.ru/templates/winscreen/fonts/ 18 KB
18 KB 16ms
12ms Font
application/octet-stream 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.winscreen.ru/templates/winscreen/fonts/glyphicons-halflings-regular.woff2
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/bootstrap.min.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: cb396393c131880c90c7bb161cce937cedcd85b449dd98d3021fecdacba8c1a9

Request headers

Referer: http://www.winscreen.ru/templates/winscreen/style/bootstrap.min.css
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:13:51 GMT
Server: nginx/1.6.2
ETag: "f600bb-466c-513eb59f4a1c0"
Content-Type: text/plain; charset=cp1251
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18028

GET
H/1.1 200
OK jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v16/ 44 KB
45 KB 78ms
40ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v16/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 02 Feb 2022 20:23:44 GMT
X-Content-Type-Options: nosniff
Age: 495079
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 45300
X-XSS-Protection: 0
Last-Modified: Wed, 26 Jan 2022 18:57:55 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Thu, 02 Feb 2023 20:23:44 GMT

GET
H/1.1 200
OK jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2
fonts.gstatic.com/s/ptsans/v16/ 29 KB
30 KB 78ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v16/jizfRExUiTo99u79B_mh0OqtLQ0Z.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400,700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a045fdc088409e4e87d57617de7a9b613bf251c12997180910faeed8fa7aba1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 02 Feb 2022 20:24:43 GMT
X-Content-Type-Options: nosniff
Age: 495020
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 29928
X-XSS-Protection: 0
Last-Modified: Wed, 26 Jan 2022 18:57:39 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Thu, 02 Feb 2023 20:24:43 GMT

GET
H/1.1 200
OK BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Oma2RjRdE.woff2
fonts.gstatic.com/s/robotoslab/v22/ 8 KB
9 KB 78ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/robotoslab/v22/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Oma2RjRdE.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Roboto+Slab:700&subset=latin,cyrillic-ext

Protocol

HTTP/1.1

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a417a4556116caa8a777aaccbedc27fe4854de9a34f4de2912582c09630a8450

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://www.winscreen.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 03 Feb 2022 20:00:53 GMT
X-Content-Type-Options: nosniff
Age: 410050
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 8120
X-XSS-Protection: 0
Last-Modified: Thu, 03 Feb 2022 00:14:02 GMT
Server: sffe
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes"
Expires: Fri, 03 Feb 2023 20:00:53 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

http://counter.yadro.ru/hit?t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607
https://counter.yadro.ru/hit?t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607
https://counter.yadro.ru/hit?q;t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607

140 B
626 B

42ms
42ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

HTTP/1.1

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host210.rax.ru

Software

nginx/1.17.9 /

Resource Hash

a92f2b3edb0d9f5e017eaf110749e21ce9aea2121cc492145837afd222a8416e

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 13:55:03 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 140
Expires: Sun, 07 Feb 2021 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 13:55:03 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;t44.1;r;s1600*1200*24;uhttp%3A//www.winscreen.ru/;0.24019145594382607
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sun, 07 Feb 2021 21:00:00 GMT

GET
H2

200

watch.js Show response
mc.yandex.ru/metrika/
Redirect Chain

http://mc.yandex.ru/metrika/watch.js
https://mc.yandex.ru/metrika/watch.js

137 KB
49 KB

125ms
62ms

Script
application/javascript

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

cf7dd5eb3e2ec460a58cf20dab3cb831e4e9ce6190986f8aab4a47721d0e7ecc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
content-encoding: br
last-modified: Tue, 08 Feb 2022 09:39:45 GMT
etag: "62021031-c351"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 50001
expires: Tue, 08 Feb 2022 14:55:03 GMT

Redirect headers

Location: https://mc.yandex.ru/metrika/watch.js
Content-Length: 0

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

49 KB
20 KB

127ms
40ms

Script
text/javascript

2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1209
date: Tue, 08 Feb 2022 13:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 08 Feb 2022 15:34:54 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK m1.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
1 KB 17ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m1.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: a1823da9349080e6c377b88eea46e384151c8424f228e8a3e8c4b5a0003c8f4a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-4b1"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1201

GET
H/1.1 200
OK m2.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
1 KB 16ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m2.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: ee7c72aafa3fa8156b44f5f03ef7fe6ecb4ea22a0eb29ffef7697260cfb5a634

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-4bb"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1211

GET
H/1.1 200
OK m3.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
1 KB 17ms
12ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m3.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 37460b56a81b10acc5885316e4d99001d2eb89cc545b98f2271ca52abf251dbc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-45b"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1115

GET
H/1.1 200
OK m4.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
1 KB 19ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m4.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: f156746cfd8351df7631eeecfabb3b0c8a04313672624aa3a904d4076bdbaf89

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-46a"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1130

GET
H/1.1 200
OK m5.jpg
www.winscreen.ru/templates/winscreen/images/ 745 B
983 B 16ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m5.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 21515fafebf34651647754d67e99b7d7a613a9d13fd0490d9c9a00f07b1c600e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-2e9"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 745

GET
H/1.1 200
OK cat11.png
www.ruprograms.ru/ 434 B
671 B 250ms
11ms Image
image/png 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.ruprograms.ru/cat11.png
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 8e21bd1f3eb874fa1825b7bc7127337cd8d7fcb8b5dc31004143c6aa8915703f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Wed, 11 Sep 2019 10:09:47 GMT
Server: nginx/1.6.2
ETag: "5d78c7eb-1b2"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 434

GET
H/1.1 200
OK m6.jpg
www.winscreen.ru/templates/winscreen/images/ 1 KB
1 KB 12ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m6.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 6e344d3a1aa3ad3d07e544bed706984d2468bdc29a6472bf17fbd34199823d94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-460"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1120

GET
H/1.1 200
OK m7.jpg
www.winscreen.ru/templates/winscreen/images/ 1003 B
1 KB 12ms
11ms Image
image/jpeg 176.9.19.123
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.winscreen.ru/templates/winscreen/images/m7.jpg
Requested by: Host: www.winscreen.ru
URL: http://www.winscreen.ru/templates/winscreen/style/main.css
Protocol: HTTP/1.1
Server: 176.9.19.123 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.123.19.9.176.clients.your-server.de
Software: nginx/1.6.2 /
Resource Hash: 7f74599ff8b9eb21dcf32bcde7b489090ee4de4760169a13b63a4166fe560998

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/templates/winscreen/style/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 13:55:03 GMT
Last-Modified: Fri, 17 Apr 2015 13:12:45 GMT
Server: nginx/1.6.2
ETag: "553106cd-3eb"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1003

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010101/ 286 KB
104 KB 146ms
64ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2341767616098055&plah=www.winscreen.ru&bust=31064709

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99fe30086fdc5554805288c95b886ec401536990a64bc42464296b264ecee589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105570
x-xss-protection: 0
server: cafe
etag: 5047939431591719432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 08 Feb 2022 13:55:03 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220203/r20190131/ Frame 7DCE 10 KB
5 KB 124ms
39ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220203/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Mon, 07 Feb 2022 15:48:54 GMT
expires: Mon, 21 Feb 2022 15:48:54 GMT
cache-control: public, max-age=1209600
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
age: 79569
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
209 B 46ms
46ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=468916726&t=pageview&_s=1&dl=http%3A%2F%2Fwww.winscreen.ru%2F&ul=en-us&de=windows-1251&dt=WinScreen%20%E2%80%94%20%D0%B2%D1%81%D1%91%20%D0%B4%D0%BB%D1%8F%20%D0%BE%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20Windows%2010&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=739258896&gjid=1436549316&cid=1435827279.1644328504&tid=UA-3929613-23&_gid=895732271.1644328504&_r=1&_slc=1&z=1120130551

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.winscreen.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.winscreen.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
442 B 57ms
19ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3929613-23&cid=1435827279.1644328504&jid=739258896&gjid=1436549316&_gid=895732271.1644328504&_u=IEBAAEAAAAAAAC~&z=112834302

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.winscreen.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 08 Feb 2022 13:55:03 GMT
content-type: text/plain
access-control-allow-origin: http://www.winscreen.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9543.4OJ1q9iVvKiDd0N18bMQL0StTOEWDeY5SO8P6ZrqejOit7rSpDedx_jEAmupC6sy.smIKH_g3JwEFa4vtswyFUCEmoXI%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9543.JJCaY11Mcp8y6Uh-2hLCS67WhB2pKqKGQq8KyWVSzTZYJ3oITg0ucgFXzU1Y4AGfSezdbAV8BvqhU-c1lp4MOQ%2C%2C.GeP96P6NX7EasBTKqkxNj2E8too%2C

75 B
75 B

33ms
33ms

Image
text/html

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9543.JJCaY11Mcp8y6Uh-2hLCS67WhB2pKqKGQq8KyWVSzTZYJ3oITg0ucgFXzU1Y4AGfSezdbAV8BvqhU-c1lp4MOQ%2C%2C.GeP96P6NX7EasBTKqkxNj2E8too%2C

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9543.JJCaY11Mcp8y6Uh-2hLCS67WhB2pKqKGQq8KyWVSzTZYJ3oITg0ucgFXzU1Y4AGfSezdbAV8BvqhU-c1lp4MOQ%2C%2C.GeP96P6NX7EasBTKqkxNj2E8too%2C
date: Tue, 08 Feb 2022 13:55:03 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
135 B 108ms
31ms Image
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
last-modified: Mon, 07 Feb 2022 09:29:50 GMT
etag: "6200bc5e-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Tue, 08 Feb 2022 14:55:03 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 149ms
62ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3929613-23&cid=1435827279.1644328504&jid=739258896&_u=IEBAAEAAAAAAAC~&z=107089067

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 147ms
60ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3929613-23&cid=1435827279.1644328504&jid=739258896&_u=IEBAAEAAAAAAAC~&z=107089067

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
646 B 135ms
47ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.winscreen.ru&callback=_gfp_s_&client=ca-pub-2341767616098055

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2341767616098055&plah=www.winscreen.ru&bust=31064709

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

8acdf27d91209b136bb757018bfb13fce5688c811f019f1ef4f872cf88f03bab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 134ms
47ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.winscreen.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 13:55:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 137ms
50ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.winscreen.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 13:55:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3F08 236 KB
62 KB 619ms
574ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&adk=1812271804&adf=3025194257&lmt=1644328503&plat=3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.winscreen.ru%2F&ea=0&flash=0&pra=5&wgl=1&dt=1644328503466&bpp=2&bdt=290&idt=250&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4789806377679&frm=20&pv=2&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=263

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccffef60c92a11ff39c05cc2ae20b8f0459a48f021eda1273fe6e61f6c5501f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 08 Feb 2022 13:55:04 GMT
server: cafe
content-length: 63845
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Feb 2022 13:55:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C07F 83 KB
31 KB 655ms
620ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=3758274007&adk=2455135674&adf=2780431300&pi=t.ma~as.3758274007&w=336&lmt=1644328503&psa=0&format=336x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&wgl=1&dt=1644328503468&bpp=1&bdt=293&idt=266&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=642&ady=1185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=9ivGzPJqor&p=http%3A//www.winscreen.ru&dtd=271

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

718e702f311f269c29bb8d45d222276ffa1cb0ae70030c9942fc4a2c3429f0c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 08 Feb 2022 13:55:04 GMT
server: cafe
content-length: 31527
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Feb 2022 13:55:04 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4295 22 KB
9 KB 757ms
726ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=7130542809&adk=584184861&adf=1706824535&pi=t.ma~as.7130542809&w=1158&fwrn=4&fwrnh=100&lmt=1644328503&rafmt=1&psa=0&format=1158x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1644328503469&bpp=2&bdt=293&idt=272&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=221&ady=1598&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=6tVQ3nYNnZ&p=http%3A//www.winscreen.ru&dtd=275

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7ca7c2cc0e9d110823b8b289858152f6aed89205659def2d2b8c01f260815c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 08 Feb 2022 13:55:04 GMT
server: cafe
content-length: 9454
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Feb 2022 13:55:04 GMT
cache-control: private

GET
H2

200

1 Show response
mc.yandex.com/watch/30260682/
Redirect Chain

https://mc.yandex.com/watch/30260682?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-125...
https://mc.yandex.com/watch/30260682/1?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-1...

331 B
413 B

32ms
31ms

XHR
application/json

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/30260682/1?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A751%3Acn%3A1%3Adp%3A0%3Als%3A462387153687%3Ahid%3A627664240%3Az%3A0%3Ai%3A20220208135503%3Aet%3A1644328504%3Ac%3A1%3Arn%3A713918268%3Arqn%3A1%3Au%3A1644328504965726956%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Antf%3A1%3Ans%3A1644328502899%3Ads%3A211%2C10%2C52%2C11%2C0%2C0%2C%2C205%2C8%2C%2C%2C%2C490%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1644328504%3At%3AWinScreen%20%E2%80%94%20%D0%B2%D1%81%D1%91%20%D0%B4%D0%BB%D1%8F%20%D0%BE%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20Windows%2010&t=gdpr%2814%29aw%281%29ti%282%29

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

94f3c792becf4688b2b050377dd965394ba916c68481bb4bc32c926a1040ff15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:03 GMT
x-content-type-options: nosniff
last-modified: Tue, 08-Feb-2022 13:55:03 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: http://www.winscreen.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 331
x-xss-protection: 1; mode=block
expires: Tue, 08-Feb-2022 13:55:03 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:03 GMT
last-modified: Tue, 08-Feb-2022 13:55:03 GMT
location: /watch/30260682/1?wmode=7&page-url=http%3A%2F%2Fwww.winscreen.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Agqny5kf8o1qwi6kkxr%3Afp%3A494%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A751%3Acn%3A1%3Adp%3A0%3Als%3A462387153687%3Ahid%3A627664240%3Az%3A0%3Ai%3A20220208135503%3Aet%3A1644328504%3Ac%3A1%3Arn%3A713918268%3Arqn%3A1%3Au%3A1644328504965726956%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Antf%3A1%3Ans%3A1644328502899%3Ads%3A211%2C10%2C52%2C11%2C0%2C0%2C%2C205%2C8%2C%2C%2C%2C490%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1644328504%3At%3AWinScreen%20%E2%80%94%20%D0%B2%D1%81%D1%91%20%D0%B4%D0%BB%D1%8F%20%D0%BE%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F%20Windows%2010&t=gdpr%2814%29aw%281%29ti%282%29
strict-transport-security: max-age=31536000
access-control-allow-origin: http://www.winscreen.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 08-Feb-2022 13:55:03 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010101/ 150 KB
53 KB 125ms
77ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010101/reactive_library_fy2019.js?bust=31064709

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32a6be76759f54db2cbd24b6200fb6d046f7de600f5190c84b768cd569aeb2b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54421
x-xss-protection: 0
server: cafe
etag: 10374646163137955415
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C07F 6 KB
1 KB 132ms
45ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=3758274007&adk=2455135674&adf=2780431300&pi=t.ma~as.3758274007&w=336&lmt=1644328503&psa=0&format=336x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&wgl=1&dt=1644328503468&bpp=1&bdt=293&idt=266&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=642&ady=1185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=9ivGzPJqor&p=http%3A//www.winscreen.ru&dtd=271

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 13:24:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 08 Feb 2022 13:55:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C07F 1 KB
954 B 167ms
70ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:46:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 512
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:46:32 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/ Frame C07F 19 KB
8 KB 125ms
36ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d131b602e0aae6d6376f9182bba1a12fae13a3708812306888f24c4f8391df52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7737
x-xss-protection: 0
server: cafe
etag: 12177500945756559572
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:47:49 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C07F 2 KB
1 KB 159ms
71ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:42 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C07F 14 KB
6 KB 129ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0243d61ce86c672bb13744b9572ab45c1131e62f4f02ad2e1a1df54f02f2b1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6201
x-xss-protection: 0
server: cafe
etag: 16063203490821389409
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:54:55 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C07F 124 KB
38 KB 106ms
78ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cecd27ce9737114e23fa8dda3be3041f7c36cdafd31822d2e5bae793669bd13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644237382599929"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 ff20f166b0acb5bbc58563e896201b58.js Show response
www.gstatic.com/mysidia/ Frame C07F 27 KB
12 KB 127ms
39ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff20f166b0acb5bbc58563e896201b58.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 23:19:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 22:35:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 03 May 2022 23:19:44 GMT

GET
H2 200 2076313506083323656
tpc.googlesyndication.com/simgad/6647445104370775115/ Frame C07F 34 KB
35 KB 160ms
72ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6647445104370775115/2076313506083323656

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7a1d3258c7355d9ea47c807b733fa8d59558235bef21d57dcab853cceb84b9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 10:43:29 GMT
x-content-type-options: nosniff
age: 529895
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35324
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 08:41:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 02 Feb 2023 10:43:29 GMT

GET
DATA 200
OK truncated
/ Frame C07F 220 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86c2cd2fe44b0b8f11f0980adfa9030b61d97a70d3df1dec75ede4588c3f0ae9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C07F 0
0 80ms
80ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C0V7RN3YCYv3QMsWNiQbv_JOIDoei15poqrGY-Y4PloLNhYgWEAEg4-2EFmCV4pCCoAegAevK36UByAEJqQIqAsgMdSKzPqgDAcgDywSqBMUBT9BQ23zNJkB1A6SuYEbmw8UXgbJglOVMuL2gNNd5lhJuvIy98atfs8tY9YjFXC6_FIu1ghXyb1wvV5oqy2xAJRT4XClfSn0lJzHjQIzEeWHftlWXfUIwk8DGmnuUyL2JSLA1q7VLBIyeg_Lc69lq4mwriB3nzzXkLWpKPvf41Jtwf-kHEjJ9L-s1GbqC0y-liWObtwxGvyjISwtlkgkpbl8qcBPU26MNgBLMsh3f44LJK6KGrbZ50cyYPNdk-0QAkHLYe4LABJqV15TqA5IFBAgEGAGSBQQIBRgEoAYugAf9tKDaAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcFELzEnQHSCAkIgOGAEBABGB-ACgHICwHYEw2IFALQFQGYFgGAFwGyFxwKGggAEhRwdWItMjM0MTc2NzYxNjA5ODA1NRgA&sigh=LCcJSlHfus8&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=3758274007&adk=2455135674&adf=2780431300&pi=t.ma~as.3758274007&w=336&lmt=1644328503&psa=0&format=336x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&wgl=1&dt=1644328503468&bpp=1&bdt=293&idt=266&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=642&ady=1185&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=9ivGzPJqor&p=http%3A//www.winscreen.ru&dtd=271
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 08 Feb 2022 13:55:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame 4295 2 KB
1 KB 78ms
70ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=7130542809&adk=584184861&adf=1706824535&pi=t.ma~as.7130542809&w=1158&fwrn=4&fwrnh=100&lmt=1644328503&rafmt=1&psa=0&format=1158x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1644328503469&bpp=2&bdt=293&idt=272&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=221&ady=1598&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=6tVQ3nYNnZ&p=http%3A//www.winscreen.ru&dtd=275

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:42 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4295 124 KB
38 KB 76ms
76ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cecd27ce9737114e23fa8dda3be3041f7c36cdafd31822d2e5bae793669bd13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644237382599929"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame 4295 14 KB
6 KB 51ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0243d61ce86c672bb13744b9572ab45c1131e62f4f02ad2e1a1df54f02f2b1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6201
x-xss-protection: 0
server: cafe
etag: 16063203490821389409
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:54:55 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4295 0
0 111ms
110ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CCdCaN3YCYojeMoeaZZGnlMACyZ7SsVyVyZT3cMCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yMzQxNzY3NjE2MDk4MDU1oAHVttLqA8gBCakCzuB3kLwisz6oAwGqBLwBT9Ck2NliDDk--Ik9WlaxJNnemD52HLxXuSzsmikiobZ9KUH3HLKrMvKwM5Hzzvpt3dW3niFLIFRlaII5USYjjZk_Y90M2vFW9TzfAi_zT-vUjoyk1uieYZT601GscoSS5nXZ9x9pVephVSLrvhm5M8RmBzwrWCygHUu3BLrB5CvVLgymnq081mHtJ8ANUM2fqGvr7rm0-29Bf-kF2NQtt19_rmDhy2ZFLhRYtQQiQwadQrMcVrYMWc90d3mABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTIzNDE3Njc2MTYwOTgwNTUYAA&sigh=gXRtynib0gA&uach_m=[UACH]&cid=CAQSGwCNIrLM4ftuG64ARvc-FTyOVfseK_BvUBYy6BgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2341767616098055&output=html&h=280&slotname=7130542809&adk=584184861&adf=1706824535&pi=t.ma~as.7130542809&w=1158&fwrn=4&fwrnh=100&lmt=1644328503&rafmt=1&psa=0&format=1158x280&url=http%3A%2F%2Fwww.winscreen.ru%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1644328503469&bpp=2&bdt=293&idt=272&shv=r20220203&mjsv=m202202010101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C336x280&nras=1&correlator=4789806377679&frm=20&pv=1&ga_vid=1435827279.1644328504&ga_sid=1644328504&ga_hid=468916726&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=221&ady=1598&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064709%2C31064729%2C31062931&oid=2&pvsid=4243298627601472&pem=797&tmod=351401897&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=6tVQ3nYNnZ&p=http%3A//www.winscreen.ru&dtd=275
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 08 Feb 2022 13:55:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 4295 0
0 690ms
18ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UOb8EMz6RIYJmAKdg2ICAgAAABKt3xbeDlL6EDd2AmJaKVvrVA1FPJEaIAAS&wp=YgJ2NwAMrwgKGU0HAAUTkf97aDfkUda9UD3LUQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
server: Kestrel
server-processing-duration-in-ticks: 256463
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 0447 206 KB
57 KB 182ms
137ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YgJ2NwAMrwgKGU0HAAUTkf97aDfkUda9UD3LUQ&u=%7Cu11yF5CJ%2FO1PoFrqMz6JbXtdPfj12nKJ0m7%2FLPq5JZY%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy1B5BQQR8kQeJwdGNspOzMyGgUjSRvIlPUgkKp68amMVmQjxCirFEcNAXP16rI4BJguurh-7vkkUZKa8cSeyHa4jKQuO5hw49Tej7Pov_JkUTAxk6MFRyqeeROR2HE1U2o83ueu5Q2Q9uXVoqfoPDIhN10hTVfYzM93-59-sGsIZTd9xXgzPU8B44jIZeIS09ZybBlpLguOeqmWABU95gGatZ0PNmcW16fhibe1BEM0kztNDIRCb9Nk5G6B9E-7bQyUDzjwPJpGatfgi-JbA3vsGlZ5jDA6RR5RRfGEePjUZLRzpWVgA0YudQwtMXOr1u7dhggJoKwI5JNPWBfX4FrIJwxqWPlrh6xGfkOWcRnOQqlVZCjMB0r8gZDvTMtOIWRX0sNpLbfsR&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVbURN3YCYojeMoeaZZGnlMACyZ7SsVyVyZT3cMCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yMzQxNzY3NjE2MDk4MDU1oAHVttLqA8gBCakCzuB3kLwisz6oAwGqBL8BT9Ck2NliDDk--Ik9WlaxJNnemD52HLxXuSzsmikiobZ9KUH3HLKrMvKwM5Hzzvpt3dW3niFLIFRlaII5USYjjZk_Y90M2vFW9TzfAi_zT-vUjoyk1uieYZT601GscoSS5nXZ9x9pVephVSLrvhm5M8RmBzwrWCygHUu3BLrB5CvVLgymnq081mHtJ8ANUM2fqGvr7rm0uW1g7W6KRMeSK0vcfl1HM29RJKJSmxyg986g5EGjSJoU3GXwZMbuOHKABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2LbvQ2ekwmaFJn_n_7N8KUk3dk3Q%26client%3Dca-pub-2341767616098055%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0a45443581a5386e18e78647576a339a1d7d187c77a744106e84f58e4061b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Tue, 08 Feb 2022 13:55:03 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=F75SG_JyrUR3PhClkzTw5C75e_cZ4gyuu7eAKhuHZHzzhBqOgdN2sPjchF9eauVgNctMr0VdokWVD7FnoFLOC7AcoQt-a8wREet61gaIAJGHXVBuOQJSJUyXH0TlMtvqwRg-MtuYrvK_PlZsnV79rZRDr3t9NECPqlQds2lKqVpS3d1_r0zgLtQKVzeq2K6YISI9Zm5dwoUDIctKrd-GrzakgLT4xuBpgCYgeBwwawoZh4ehOQyOjNntLO0XDdThlTkxKQ"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 121095979
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 95ms
47ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.winscreen.ru

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 95ms
47ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.winscreen.ru

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/ Frame D80A 10 KB
5 KB 36ms
36ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Mon, 07 Feb 2022 17:19:11 GMT
expires: Mon, 21 Feb 2022 17:19:11 GMT
cache-control: public, max-age=1209600
age: 74153
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/ Frame C702 10 KB
5 KB 37ms
37ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Mon, 07 Feb 2022 17:19:11 GMT
expires: Mon, 21 Feb 2022 17:19:11 GMT
cache-control: public, max-age=1209600
age: 74153
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C07F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d836b2bd6fbf7af2851adda03c093d93eaad738bd491159a28ef8a0ee6b9a0f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 4295 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15ad8027ac645e6daf1e1c44ba169458374e52d4994a3275dced75ae5b1d7886

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C07F 15 KB
16 KB 125ms
39ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 09:48:03 GMT
x-content-type-options: nosniff
age: 360421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 04 Feb 2023 09:48:03 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C07F 15 KB
16 KB 135ms
51ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 503925
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 02 Feb 2023 17:56:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C07F 15 KB
15 KB 166ms
83ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 17:58:32 GMT
x-content-type-options: nosniff
age: 503792
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 02 Feb 2023 17:58:32 GMT

GET
H3 200 OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4B32 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

389b0f79294835e272cce417a53bed0fd70c807ab82b8617239d1f8c0d31bd07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 10:38:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11809
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13596
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Feb 2023 10:38:15 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame D80A 4 KB
634 B 94ms
47ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 13:25:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 08 Feb 2022 13:55:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D80A 205 B
229 B 81ms
37ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 20:26:54 GMT
x-content-type-options: nosniff
age: 62890
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 07 Feb 2023 20:26:54 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D80A 604 B
628 B 81ms
38ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 15:57:11 GMT
x-content-type-options: nosniff
age: 165473
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 06 Feb 2023 15:57:11 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/elements/html/ Frame D80A 19 KB
8 KB 100ms
51ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07614ab88c31c77c94dfcb6725b83bc64cf43d147dd0c371d2c64016aefb8f44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8082
x-xss-protection: 0
server: cafe
etag: 1670727572542866603
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:00:38 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C702 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CpfnPN3YCYsinMYaXtweGo7_gBIei15posf_48YwPrJzAu9oaEAEg4-2EFmCV4pCCoAegAevK36UByAECqQLRJ67qQCyzPqgDAcgDyQSqBMYBT9Au018-XIYNk-4F49CNMnheAJ6eqjbnEEc704EVATpR-aHNHuDmYCctIa6-47UthaU5lDao-vmXZkcUyJj6zUUV87tR8xjJOdTLP_Pv6XAktJ70pILJ2EOkXQKZWds12VXX_I7UDV6z3xq9x8O26MbVKJYCjVRdGx39NJ9sK_LeeK2TEkT7YMil6_BlBGGzTAdiFkwdPDMMVJT_vZZ-BWHKvKK8lZi3ErP-N4aOMchX4zWTuJiaEk_m1EG7zSxNKUD0I6RYwASaldeU6gOSBQQIBBgBkgUECAUYBKAGAoAH_bSg2gKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBRCliYUC0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTIzNDE3Njc2MTYwOTgwNTUYAA&sigh=Zxa92DF_LdM&uach_m=[UACH]

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 08 Feb 2022 13:55:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/ Frame C702 19 KB
8 KB 46ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d131b602e0aae6d6376f9182bba1a12fae13a3708812306888f24c4f8391df52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7737
x-xss-protection: 0
server: cafe
etag: 12177500945756559572
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:47:49 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C702 2 KB
1 KB 72ms
67ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:42 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C702 124 KB
38 KB 105ms
104ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cecd27ce9737114e23fa8dda3be3041f7c36cdafd31822d2e5bae793669bd13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644237382599929"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C702 14 KB
6 KB 50ms
45ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0243d61ce86c672bb13744b9572ab45c1131e62f4f02ad2e1a1df54f02f2b1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6201
x-xss-protection: 0
server: cafe
etag: 16063203490821389409
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:41 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame C702 27 KB
11 KB 61ms
56ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59de64323ab5ba442cf41959d2ba1ed8ce18b7fe44467097a9af277f3625697

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 15:48:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79602
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11448
x-xss-protection: 0
server: cafe
etag: 7248745701340543915
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 15:48:22 GMT

GET
H3 200 5530076399323130197
tpc.googlesyndication.com/daca_images/simgad/ Frame C702 19 KB
19 KB 74ms
70ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/5530076399323130197

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d1949726e98e03c8295baea93c673dfcae3384816b957fcb2e247f4d5fc9fb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:18:52 GMT
x-content-type-options: nosniff
age: 131772
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19481
x-xss-protection: 0
last-modified: Tue, 07 Dec 2021 14:01:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 07 Feb 2023 01:18:52 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 0447 2 KB
1 KB 58ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YgJ2NwAMrwgKGU0HAAUTkf97aDfkUda9UD3LUQ&u=%7Cu11yF5CJ%2FO1PoFrqMz6JbXtdPfj12nKJ0m7%2FLPq5JZY%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy1B5BQQR8kQeJwdGNspOzMyGgUjSRvIlPUgkKp68amMVmQjxCirFEcNAXP16rI4BJguurh-7vkkUZKa8cSeyHa4jKQuO5hw49Tej7Pov_JkUTAxk6MFRyqeeROR2HE1U2o83ueu5Q2Q9uXVoqfoPDIhN10hTVfYzM93-59-sGsIZTd9xXgzPU8B44jIZeIS09ZybBlpLguOeqmWABU95gGatZ0PNmcW16fhibe1BEM0kztNDIRCb9Nk5G6B9E-7bQyUDzjwPJpGatfgi-JbA3vsGlZ5jDA6RR5RRfGEePjUZLRzpWVgA0YudQwtMXOr1u7dhggJoKwI5JNPWBfX4FrIJwxqWPlrh6xGfkOWcRnOQqlVZCjMB0r8gZDvTMtOIWRX0sNpLbfsR&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVbURN3YCYojeMoeaZZGnlMACyZ7SsVyVyZT3cMCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yMzQxNzY3NjE2MDk4MDU1oAHVttLqA8gBCakCzuB3kLwisz6oAwGqBL8BT9Ck2NliDDk--Ik9WlaxJNnemD52HLxXuSzsmikiobZ9KUH3HLKrMvKwM5Hzzvpt3dW3niFLIFRlaII5USYjjZk_Y90M2vFW9TzfAi_zT-vUjoyk1uieYZT601GscoSS5nXZ9x9pVephVSLrvhm5M8RmBzwrWCygHUu3BLrB5CvVLgymnq081mHtJ8ANUM2fqGvr7rm0uW1g7W6KRMeSK0vcfl1HM29RJKJSmxyg986g5EGjSJoU3GXwZMbuOHKABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2LbvQ2ekwmaFJn_n_7N8KUk3dk3Q%26client%3Dca-pub-2341767616098055%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 0447 2 KB
1 KB 64ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 0447 308 B
636 B 16ms
14ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 0447 507 B
835 B 20ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 0447 0
460 B 138ms
99ms Image
text/plain 2600:9000:206f:2a00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1644328504
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YgJ2NwAMrwgKGU0HAAUTkf97aDfkUda9UD3LUQ&u=%7Cu11yF5CJ%2FO1PoFrqMz6JbXtdPfj12nKJ0m7%2FLPq5JZY%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpMoZ3wmmJmKy1B5BQQR8kQeJwdGNspOzMyGgUjSRvIlPUgkKp68amMVmQjxCirFEcNAXP16rI4BJguurh-7vkkUZKa8cSeyHa4jKQuO5hw49Tej7Pov_JkUTAxk6MFRyqeeROR2HE1U2o83ueu5Q2Q9uXVoqfoPDIhN10hTVfYzM93-59-sGsIZTd9xXgzPU8B44jIZeIS09ZybBlpLguOeqmWABU95gGatZ0PNmcW16fhibe1BEM0kztNDIRCb9Nk5G6B9E-7bQyUDzjwPJpGatfgi-JbA3vsGlZ5jDA6RR5RRfGEePjUZLRzpWVgA0YudQwtMXOr1u7dhggJoKwI5JNPWBfX4FrIJwxqWPlrh6xGfkOWcRnOQqlVZCjMB0r8gZDvTMtOIWRX0sNpLbfsR&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVbURN3YCYojeMoeaZZGnlMACyZ7SsVyVyZT3cMCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0yMzQxNzY3NjE2MDk4MDU1oAHVttLqA8gBCakCzuB3kLwisz6oAwGqBL8BT9Ck2NliDDk--Ik9WlaxJNnemD52HLxXuSzsmikiobZ9KUH3HLKrMvKwM5Hzzvpt3dW3niFLIFRlaII5USYjjZk_Y90M2vFW9TzfAi_zT-vUjoyk1uieYZT601GscoSS5nXZ9x9pVephVSLrvhm5M8RmBzwrWCygHUu3BLrB5CvVLgymnq081mHtJ8ANUM2fqGvr7rm0uW1g7W6KRMeSK0vcfl1HM29RJKJSmxyg986g5EGjSJoU3GXwZMbuOHKABtSgisukm6ijbKAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2LbvQ2ekwmaFJn_n_7N8KUk3dk3Q%26client%3Dca-pub-2341767616098055%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:2a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:04 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-C1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: 9O2A1dBiX4s9GsGLp8VyusUwtj8Cfhscxthw11-w70UZblW7qtqRyA==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 0447 43 B
347 B 402ms
17ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=Mf4qEKIgar3PdS5R9BM-mVDRxQVve5UVyJpMZPQjV4XnElJfuJzS04xsFOz9nhBH5-Ut36U_RYhoX2xsAPmc_veoEsYZMSSCttIBg46N0b7jmqwwqxm78K66xLKyv9nQMk2yn6pVbHhUqpKXfjb515oDd78ehkhEKBWHRxKmEBwn465Di7fu9uUlb5Td8m1xU83l-mD9ICX6A5XBlvkICdKqdtNG_-5foCGF-dE3tq3ZqxRRHok50hrGnprp5i8b8RoAFp4FOGg_esiJillnGkEvpIPcSpCFHfQpz_fIvihBcdcsq6SCxuCnB5L6uUdkhjSfMurClVM7c_IOZLbxLX3gieBgEqBGIvaM_vRKjBQT5CHjdPsTscpZGPZPi6U8Bo8ud3i8fVgtIyI8aJlGT6SoVdyjyVnV81JjDHCf2HnplTqc4VwbaNfvhsCusNS3d3vmdQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:04 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1669233
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 0447 12 KB
6 KB 17ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 7 KB
7 KB 195ms
41ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F79f2c646e3f74b54931cff1f39d769d0_blue.png&v=3&w=196&s=nkm37OBN4xyh5x9UPHeLVYZl

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

bfcd7a262745ac2a8520d46dbe261c5db424c001970e9ebe83c440bfb48454f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29795530
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6722
expires: Thu, 19 Jan 2023 10:27:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 2 KB
2 KB 195ms
41ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FS%2FlogoSTEAG-Energy-Services-GmbH-97448DE.gif%3Feb%3D1&v=3&w=800&s=m3B7LgXpicKyu_27UNqqy4oX&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8f9c1eab75ff570164c8be34aed9bf7b5cf97dc694a06f513296e024d25e8de8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1180819
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1636
expires: Tue, 22 Feb 2022 05:55:24 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 400 B
662 B 196ms
42ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoDB_Mobility_Logistics_AG_60544DE.gif%3Feb%3D1&v=3&w=800&s=0y_71H41LXRUcFG_iY9j6SKC&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

42c9e4f9d8c14ea0ecac49e147f029a6bb58b69e544bd63667e5b0e64169f631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=775979
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 400
expires: Thu, 17 Feb 2022 13:28:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 1 KB
2 KB 195ms
42ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FF%2Flogofinanzen-net-GmbH-143563DE.gif%3Feb%3D1&v=3&w=800&s=Y_QghVtb-LPpQSnxX6JqEGqy&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

369081185de8c3ddc58ba1e4c57febecc919b3362125e2828cd5dc60813392e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2518428
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1414
expires: Wed, 09 Mar 2022 17:28:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 2 KB
2 KB 196ms
43ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FK%2FlogoKPMG-AG-Wirtschaftsprufungsgesellschaft-Berlin-8038DE.gif%3Feb%3D1&v=3&w=800&s=qLQ5dbqX_hSP7QpkzwsM5roO&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

ed7e36bbfdc81471c0197939b78fee25d2237d860623cb1d5f146ff1e6b984d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=138
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2120
expires: Tue, 08 Feb 2022 13:57:23 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 1 KB
1 KB 196ms
43ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FJ%2FlogoJS_Deutschland_GmbH_24984DE.gif%3Feb%3D1&v=3&w=800&s=kazlmmYaf1I4CAPjpV7VMXGz&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

639665b9e97aad7d30114d5b9b4d4b391d1ee6e870fd4515ec28e5a24c22863a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=506091
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1100
expires: Mon, 14 Feb 2022 10:29:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 5 KB
5 KB 19ms
16ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F2%2FlogoIntersnack-Knabber-Gebaeck-GmbH-Co-KG-129424DE.gif%3Feb%3D1&v=3&w=800&s=-nk8XX3REQpgioriZ05CWvGq&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2a1852af24e0f5d4b50970dd8ca85c9678664dc234cf5ac3bed2a4e0da7ee436

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4982
expires: Fri, 03 Feb 2023 13:55:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 2 KB
2 KB 29ms
26ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FP%2FlogoPorsche-Consulting-GmbH-4441DE.gif%3Feb%3D1&v=3&w=800&s=YWubvAS9NMgeIRr-1y-AdwEX&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

53f218496e3fb539c0c6c0d31e8287766460bf3e6ea3f115efd55cfc41ae890d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2430942
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2124
expires: Tue, 08 Mar 2022 17:10:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0447 1 KB
1 KB 18ms
15ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FZ%2FlogoZEISS-3427DE.gif%3Feb%3D1&v=3&w=800&s=RrXO-dKDwT9QyY0iBiT47Xw6&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

a6c11502463f3445d37d3184cef1016bb3c77dbc12b88636788632bfe5e87b98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=597932
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1244
expires: Tue, 15 Feb 2022 12:00:37 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 0447 0
127 B 62ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=F75SG_JyrUR3PhClkzTw5C75e_cZ4gyuu7eAKhuHZHzzhBqOgdN2sPjchF9eauVgNctMr0VdokWVD7FnoFLOC7AcoQt-a8wREet61gaIAJGHXVBuOQJSJUyXH0TlMtvqwRg-MtuYrvK_PlZsnV79rZRDr3t9NECPqlQds2lKqVpS3d1_r0zgLtQKVzeq2K6YISI9Zm5dwoUDIctKrd-GrzakgLT4xuBpgCYgeBwwawoZh4ehOQyOjNntLO0XDdThlTkxKQ&sds=2&rev=unknown&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 08 Feb 2022 13:55:04 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 0447 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 0447 2 KB
1 KB 20ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Feb 2023 13:55:04 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1E23 8 KB
888 B 52ms
51ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 12:15:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 08 Feb 2022 13:55:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame 1E23 1 KB
875 B 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:46:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 512
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:46:32 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/ Frame 1E23 19 KB
8 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d131b602e0aae6d6376f9182bba1a12fae13a3708812306888f24c4f8391df52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7737
x-xss-protection: 0
server: cafe
etag: 12177500945756559572
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:47:49 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame 1E23 2 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:42 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1E23 124 KB
38 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cecd27ce9737114e23fa8dda3be3041f7c36cdafd31822d2e5bae793669bd13f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644237382599929"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 08 Feb 2022 13:55:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/ Frame 1E23 14 KB
6 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220203/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0243d61ce86c672bb13744b9572ab45c1131e62f4f02ad2e1a1df54f02f2b1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:53:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6201
x-xss-protection: 0
server: cafe
etag: 16063203490821389409
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Feb 2022 13:53:41 GMT

GET
H3 200 ff20f166b0acb5bbc58563e896201b58.js Show response
www.gstatic.com/mysidia/ Frame 1E23 27 KB
11 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff20f166b0acb5bbc58563e896201b58.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 23:19:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 22:35:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 03 May 2022 23:19:44 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 87F5 143 B
163 B 36ms
36ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Tue, 08 Feb 2022 13:03:04 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 3120
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C702 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7547f6787952fc35ac29612b994e3b65a40755401c72ba92127a55d0cbe5b3cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 87F5
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

113ms
113ms

Document
text/html

2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 08 Feb 2022 13:55:05 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Feb 2022 13:55:05 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 08 Feb 2022 13:55:05 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4BC2 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220203/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

389b0f79294835e272cce417a53bed0fd70c807ab82b8617239d1f8c0d31bd07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 10:38:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11809
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13596
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Feb 2023 10:38:15 GMT

GET
H3 200 OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js Show response
pagead2.googlesyndication.com/bg/ Frame A36C 35 KB
13 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js

Requested by

Host: www.winscreen.ru
URL: http://www.winscreen.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

389b0f79294835e272cce417a53bed0fd70c807ab82b8617239d1f8c0d31bd07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 10:38:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13596
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Feb 2023 10:38:15 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 102ms
54ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220203&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3e7138c7291a4fd62ec752af59706a45800b72c89a0eb9b395d66b2aa1ac41b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 13:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9870
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 79ms
79ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 08 Feb 2022 13:55:05 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D58E 13 KB
5 KB 40ms
40ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 08 Feb 2022 13:50:41 GMT
expires: Wed, 08 Feb 2023 13:50:41 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 264
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8BD0 783 B
535 B 46ms
46ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3f48e7c49c8a1506094d64d925955ecead599b98074d14b7f842501072c7c496

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rkJ2H2Z4m5onNIr9rq9AyA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 08 Feb 2022 13:55:05 GMT
date: Tue, 08 Feb 2022 13:55:05 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-rkJ2H2Z4m5onNIr9rq9AyA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8BD0 0
0 89ms
88ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220203&jk=4243298627601472&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js Show response
pagead2.googlesyndication.com/bg/ Frame D58E 35 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/OJsPeSlINeJyzOQXpTvtD9cMgHq4K4YXI50fjA0xvQc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

389b0f79294835e272cce417a53bed0fd70c807ab82b8617239d1f8c0d31bd07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 10:38:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13596
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Feb 2023 10:38:15 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D58E 0
9 B 39ms
39ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?CxxF7Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 13:55:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C702 42 B
64 B 74ms
73ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssyTszrefefD5OiQ09pCNqMjtBiLdga6hkwVCinH-e-BGjDszmqvZixxtP0KK8zbNEGk4FW8szVWZAZW92--6SZyCeH5P2LhS4wxj7hRfaZBGYkx0_2FQ&sai=AMfl-YRiJD2t3o5OuoefEES74zWfbxO7MXBpOlvlucuaJyK4FLQcoKOqgtrDG-lpVHDSYtPXfAq1HG5q6A8f&sig=Cg0ArKJSzJCR1HhSiBxbEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=83,766,1000,1056,1056&tos=83,683,234,56,0&v=20220207&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1812271801&rs=2&la=0&cr=0&vs=4&r=v&rst=1644328504592&rpt=328&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220203&jk=4243298627601472&bg=!BAelB0PNAAa4sGsQuLA7ACkAdvg8WrRf2XnqX0hSfN6Krjm5Ozo_qh065KRhB7bNQyyhOFw-o-bhKAIAAABfUgAAAAJoAQeZAreCuCrHB8DDOGTylR4Bh5XV4Lw2N-gChnb-ZlfDW2Lc2rKpqyet5gl7xQYgpBynp6KtIHVkqmkT9OqBEKl3oqzeZe1dpoweMzo7W5bioZpzWX4D6vTOMuHbi5-DRjt5fwjl7uWMbUdw3MSwvqnwLjaT1ii5GVWdqyHdSdCkaoHu5JhGllRbb8fXP916tLcCO20k9amSBaZfKiH2kHVhSzPL6P7zUdCMk4tEYlfWG0u0JwwA0WMTA5C84ZKyx8hvNa6FU2U8_VG-6yhbf_FjyoQ2CY97RiFoTR-DLU56Ly9MMnALf38C0iweg35FXiU1f72WEO6GIFQZ20eTcchXGncowhDpyko9Imt3id5oXFypD8-e0j2yn_sVddaFZ63tzNdw84lc7nhKbFeqIAc83QGcC7PV_SheZzmp4aEjRWBqQxlLT-U4nhglfsIAGT9m_M7Kt1dQxvJq3vKZQxVa0yYAsAg3IJ2_lzDxy0pa1yYqmwXdSj5_0f_wU1zmrlcfAB9cG80K1q-_g3HWrJdbo8R4X1Lm_bm16L0ELXUTHOfFw8OrGEdfeckTAQlFxDMwPKQqQpdQoEtXz6-6LzivDpEhHITQ8ZxMqremktovXb9vVmtCMcn_6IYVZ30yJHekRgilu61uYZZmKwFQjyJwT8YqA-9pViG7vF3d41t6ntcBiRhJRRtzdy-6qHDcaRFxeBHrPsZEY3YFBS-AzGv30XFuYA0SQSpR6-I9eF2x7MxKKycKQkOIYTENRJSMmf52sgxL6GOb7Lpog96XCdTrmKQTLsvIXX81XrEzwjkHqn9TJdNfkmaykjL2_SGvMeo2VQsWRUlCM24y1X5hyxJFW0rqwN34jzsjvDsOPrLxIDruODCt0Fuz9C_xkMamH6No2dvPwY5d9tqUd5kbF6cZ1kvgPcJCVKUTpw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.winscreen.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 13:55:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

126 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.winscreen.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1f6729f70ba4595774ab466fcc7cf992
.winscreen.ru/	1970-01-20 18:16:40	Name: _ga Value: GA1.2.1435827279.1644328504
.winscreen.ru/	1970-01-20 00:46:54	Name: _gid Value: GA1.2.895732271.1644328504
.winscreen.ru/	1970-01-20 00:45:28	Name: _gat Value: 1
.yadro.ru/	1970-01-20 09:30:03	Name: FTID Value: 1Y0dOt1msquG1Y0dOt000UU4
.winscreen.ru/	1970-01-20 09:31:04	Name: _ym_uid Value: 1644328504965726956
.winscreen.ru/	1970-01-20 09:31:04	Name: _ym_d Value: 1644328504
.yadro.ru/	1970-01-20 09:30:03	Name: VID Value: 3HDrQu1jqXOG1Y0dOt000Dbi
.mc.yandex.com/	1970-01-20 00:45:29	Name: sync_cookie_csrf Value: 2026896330fake
.winscreen.ru/	1970-01-20 00:46:40	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 00:45:29	Name: sync_cookie_csrf Value: 3562167119fake
.winscreen.ru/	1970-01-20 10:07:04	Name: __gads Value: ID=1069e749d95e927e-22756e1038cd006b:T=1644328503:RT=1644328503:S=ALNI_MY0j8Q-Fsio88U8GkhOvxYCUDqGgw
.yandex.com/	1970-01-20 09:31:04	Name: yandexuid Value: 2817671901644328503
.yandex.com/	1970-01-20 09:31:04	Name: yuidss Value: 2817671901644328503
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1141904881644328503
.yandex.com/	1970-01-23 16:21:28	Name: i Value: 3L7sRBqYmjmGUvjHAPs1Lh1/UJnjIZIFNNTSHbBKRbbKmvmsqpmwKUtMkIOEvbSeJoeHUcSdn9glwg0cP6tmO8VZ4Ck=
.yandex.com/	1970-01-20 09:31:04	Name: ymex Value: 1675864503.yrts.1644328503#1675864503.yrtsi.1644328503
.winscreen.ru/	1970-01-20 00:45:30	Name: _ym_visorc Value: w
.doubleclick.net/	1970-01-20 10:07:04	Name: IDE Value: AHWqTUk_7_K0Q4Am653Un5rne_N2DQ2JsZH9aOXQ_squHuJal47_Ujy1ZeFPWm4UuJs
.doubleclick.net/	1970-01-20 00:45:32	Name: DSID Value: NO_DATA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9543.JJCaY11Mcp8y6Uh-2hLCS67WhB2pKqKGQq8KyWVSzTZYJ3oITg0ucgFXzU1Y4AGfSezdbAV8BvqhU-c1lp4MOQ%2C%2C.GeP96P6NX7EasBTKqkxNj2E8too%2C Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
cat.fr.eu.criteo.com
counter.yadro.ru
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
rtb.nl.eu.criteo.com
secure-gl.imrworldwide.com
static.criteo.net
stats.g.doubleclick.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.gstatic.com
www.ruprograms.ru
www.winscreen.ru
142.250.184.226
176.9.19.123
178.250.0.160
178.250.0.162
178.250.2.135
2600:9000:206f:2a00:1e:a43d:b640:93a1
2a00:1450:4001:801::2002
2a00:1450:4001:803::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:810::200e
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2004
2a00:1450:4001:831::2002
2a00:1450:400c:c08::9a
2a02:2638:1::2
2a02:2638::18
2a02:2638::3
2a02:6b8::1:119
88.212.201.210
0243d61ce86c672bb13744b9572ab45c1131e62f4f02ad2e1a1df54f02f2b1f2
07614ab88c31c77c94dfcb6725b83bc64cf43d147dd0c371d2c64016aefb8f44
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0d836b2bd6fbf7af2851adda03c093d93eaad738bd491159a28ef8a0ee6b9a0f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
15ad8027ac645e6daf1e1c44ba169458374e52d4994a3275dced75ae5b1d7886
170531dc856e5aece4c3a0b4b8a7885fd2773b5e19eca5d8ed17fde3cc55f0ca
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a045fdc088409e4e87d57617de7a9b613bf251c12997180910faeed8fa7aba1
21515fafebf34651647754d67e99b7d7a613a9d13fd0490d9c9a00f07b1c600e
22ff85ccf23206b6dfcfae06cd9451599b9cab04913526500a95d5be710efa7e
2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a
2553455ddf15cb2dd26ae9c776156c14cd4d30de5a9ba79f586916dd69f220f2
2796b7ead0b341319893789b7ee0a01cf0df9d2076947def19c70cf1ed5853e3
293b060eec862be1b59597dce4539862df949e5d7af849efbe4cabddb4ab33ec
2a1852af24e0f5d4b50970dd8ca85c9678664dc234cf5ac3bed2a4e0da7ee436
2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
2ee9acfeecd92aaa4867bec606dfc4ac890f4d15cafa7754372d5a88ee8db484
32a6be76759f54db2cbd24b6200fb6d046f7de600f5190c84b768cd569aeb2b0
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
369081185de8c3ddc58ba1e4c57febecc919b3362125e2828cd5dc60813392e5
37460b56a81b10acc5885316e4d99001d2eb89cc545b98f2271ca52abf251dbc
389b0f79294835e272cce417a53bed0fd70c807ab82b8617239d1f8c0d31bd07
3a149fbe4e85e25b086e886e18f24a7cf389d7b2f35e29c81d2025a953a5e13e
3a21fedf569cccca5db2f403084504ec5f68356c37615a21963f24908b2bbc0b
3cbd9dcd567cfc3c97fc13b97b9e05b8acd797212376bdc2711f9c0c993dee59
3f48e7c49c8a1506094d64d925955ecead599b98074d14b7f842501072c7c496
42c9e4f9d8c14ea0ecac49e147f029a6bb58b69e544bd63667e5b0e64169f631
430a717aeb541812e12e5144ca5a95887c42544a9ea89ae3a075442887256605
43a47caa5313298982be56a0ccd530a083d130260b2b6dfe21f5ec3827c09684
49312df390f78c111bf7ddaf6a244e26cce429f7551b9d3fa4e742ce784dc871
4d1949726e98e03c8295baea93c673dfcae3384816b957fcb2e247f4d5fc9fb6
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50c3949ea00c37ee90caee3d251b25c5dd6b0cd7a8994b10724cb63aee53e0f5
53f218496e3fb539c0c6c0d31e8287766460bf3e6ea3f115efd55cfc41ae890d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54d763b7b3f17e0c25f1bc24d729ce074d6260d6b8a5184cc21912a6c82ca90a
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
583f8b753da4971a5e70b7ceb8aa498aaefec0665d10078685cba8767a6705c7
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
639665b9e97aad7d30114d5b9b4d4b391d1ee6e870fd4515ec28e5a24c22863a
6e344d3a1aa3ad3d07e544bed706984d2468bdc29a6472bf17fbd34199823d94
718e702f311f269c29bb8d45d222276ffa1cb0ae70030c9942fc4a2c3429f0c1
7547f6787952fc35ac29612b994e3b65a40755401c72ba92127a55d0cbe5b3cd
755c45ebe08b9d47f5f59e41a2ffe4094480836090b75cc106ef59d75818150e
77893ad689369fc3fa0974092849ec516efb9916e3fed4aa96f568c377679768
7e9c22d02fc319b701844b334477a05fd32acee9668feb98672f6c27887f79cf
7ee2c2fb62c3ff276b5e38b325b44c26becb66331c106d05dbf27b12ee22c3d4
7f74599ff8b9eb21dcf32bcde7b489090ee4de4760169a13b63a4166fe560998
82e6e04cd8c38adb585a20e2ae8eb9f33db5de67c025188ef2ec0631f55c5156
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86c2cd2fe44b0b8f11f0980adfa9030b61d97a70d3df1dec75ede4588c3f0ae9
8acdf27d91209b136bb757018bfb13fce5688c811f019f1ef4f872cf88f03bab
8dd863a9399e6391b0a28cc931d88845d2b0ccd7f6eedf982f56c038ad2e4d9d
8e21bd1f3eb874fa1825b7bc7127337cd8d7fcb8b5dc31004143c6aa8915703f
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422
8f9c1eab75ff570164c8be34aed9bf7b5cf97dc694a06f513296e024d25e8de8
92dbcaa9ac6393304ed5554e85ebedbad2e9eb71cef1fb725175940316aefa38
93b8363f283fb6ce1fc8e94d54d3984cf7992f3902468b343c64fd7ed6d03963
94f3c792becf4688b2b050377dd965394ba916c68481bb4bc32c926a1040ff15
99fe30086fdc5554805288c95b886ec401536990a64bc42464296b264ecee589
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a1823da9349080e6c377b88eea46e384151c8424f228e8a3e8c4b5a0003c8f4a
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a219f9ac5cef7642ed890175e859fa245c5f599e10e01aa6f62d957a4f48067c
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a417a4556116caa8a777aaccbedc27fe4854de9a34f4de2912582c09630a8450
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b
a6c11502463f3445d37d3184cef1016bb3c77dbc12b88636788632bfe5e87b98
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a7a1d3258c7355d9ea47c807b733fa8d59558235bef21d57dcab853cceb84b9c
a92f2b3edb0d9f5e017eaf110749e21ce9aea2121cc492145837afd222a8416e
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b59de64323ab5ba442cf41959d2ba1ed8ce18b7fe44467097a9af277f3625697
bfcd7a262745ac2a8520d46dbe261c5db424c001970e9ebe83c440bfb48454f7
c8afc467191f63438c455e719dc800d90593dfee1a860e05118cb569554d7cea
c9849d1ff47146923bbe3318382f2d203817768ff1384d2ba05e734bab537c6f
cb396393c131880c90c7bb161cce937cedcd85b449dd98d3021fecdacba8c1a9
cbdf60e7ec3077e956fdcc9ed23d21a23289b3af89ac2871cd7fd1ec598a5c46
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ccffef60c92a11ff39c05cc2ae20b8f0459a48f021eda1273fe6e61f6c5501f3
cecd27ce9737114e23fa8dda3be3041f7c36cdafd31822d2e5bae793669bd13f
cf7dd5eb3e2ec460a58cf20dab3cb831e4e9ce6190986f8aab4a47721d0e7ecc
d0a45443581a5386e18e78647576a339a1d7d187c77a744106e84f58e4061b07
d131b602e0aae6d6376f9182bba1a12fae13a3708812306888f24c4f8391df52
d3e7138c7291a4fd62ec752af59706a45800b72c89a0eb9b395d66b2aa1ac41b
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
dc1e0c7f43c00eeef5863bfad474088c33f2009822a6680731577298aaf69639
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e944f656b030f2f0bdf64fd79635fb0669c1097844e6108c25cb30b328e269cc
ed7e36bbfdc81471c0197939b78fee25d2237d860623cb1d5f146ff1e6b984d0
ee7c72aafa3fa8156b44f5f03ef7fe6ecb4ea22a0eb29ffef7697260cfb5a634
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f156746cfd8351df7631eeecfabb3b0c8a04313672624aa3a904d4076bdbaf89
f4ae648d8e8f48b124ee62511e7765fbfa9057a2a6f7efa36230ecaae743bfb5
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f7ca7c2cc0e9d110823b8b289858152f6aed89205659def2d2b8c01f260815c7
f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b
fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

www.winscreen.ru Open in urlscan Pro 176.9.19.123 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

138 Requests

63 %HTTPS

74 %IPv6

17 Domains

26 Subdomains

24 IPs

5 Countries

1869 kBTransfer

3355 kBSize

20 Cookies

2 Outgoing links

Redirected requests

138 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.winscreen.ru Open in urlscan Pro
176.9.19.123 Public Scan

Screenshot
Live screenshot

Full Image

138
Requests

63 %
HTTPS

74 %
IPv6

17
Domains

26
Subdomains

24
IPs

5
Countries

1869 kB
Transfer

3355 kB
Size

20
Cookies

138 HTTP transactions
4 data transactions