csgowfire.ru Open in urlscan Pro
31.31.198.184 Public Scan

Software

nginx / PleskLin

Resource Hash

5ff26fe176fa6d4995432de254f358a2e56469fc24e454c29446871832946473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 16 Mar 2019 07:00:20 GMT
server: nginx
etag: W/"5c8c9f04-9b2"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:58 GMT

GET
H2 200 bootstrap.css
csgowfire.ru/templates/mehasha-cheat/style/ 145 KB
23 KB 97ms
96ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/bootstrap.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

45825e6999d268d3f67c9ef03331fc9d4b041712bbfe5d29e6155639aade66c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 30 Nov 2017 13:54:09 GMT
server: nginx
etag: W/"5a200d81-24497"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:58 GMT

GET
H2 200 styles.css
csgowfire.ru/templates/mehasha-cheat/style/ 53 KB
12 KB 224ms
223ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/styles.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

1d15cff80c1a532fec6f5cf601020d542cf012a79cdb22653d64d52c33941c3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 23 May 2020 10:25:27 GMT
server: nginx
etag: W/"5ec8fa17-d250"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:58 GMT

GET
H2 200 engine.css
csgowfire.ru/templates/mehasha-cheat/style/ 61 KB
22 KB 161ms
161ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/style/engine.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

9080f63613865b823bfad02fe5b6ed49a19529ebd7c362eedf142f4718927dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sun, 25 Aug 2019 14:55:05 GMT
server: nginx
etag: W/"5d62a149-f33b"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:58 GMT

GET
H2 200 font-awesome.min.css
csgowfire.ru/templates/mehasha-cheat/css/ 27 KB
6 KB 160ms
159ms Stylesheet
text/css 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:51 GMT
server: nginx
etag: W/"596f808f-6b4a"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:58 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 71ms
50ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b1bed1a460279090b4f356dccd83cca20763118a00f593f5bf83731811a1b22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51233
x-xss-protection: 0
server: cafe
etag: 8074365902429266771
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 16 Feb 2024 16:31:59 GMT

GET
H2 200 11gku.min.js Show response
newrrb.bid/ 67 KB
20 KB 300ms
115ms Script
text/javascript 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.min.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d9c122f31c18d9cfcbab4ca1a757c1dfe3b954986a80f700706051c58521674

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
duration: 245821
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 16 Feb 2024 14:49:08 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8voVd3Asv9vhGSYkFiuZEKB4iG3qROuD2A8bMbARNWvynx%2BUJmKio9ylui7r6wsqPvPqelLnxh74GXaKLuaFuRoF%2B46Mz2tnlDVNsU4gkOmL5gRUUZiywpbbS6J7y%2Fkd7ABEGk8OHUsY"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 85672f1bea7c1e1c-FRA
access-control-allow-headers: *
expires: Fri, 16-Feb-2024 18:36:59 EET

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 348 KB
99 KB 259ms
70ms Script
text/javascript 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

f3d299ac983e2854a666913a8afd92701eaab248e308d118fb009e3f4a37e474

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1708101119370469-319904610885186288-balancer-l7leveler-kubr-yp-vla-115-BAL-8322
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Fri, 16 Feb 2024 17:31:59 GMT

GET
H2 200 logo.png
csgowfire.ru/templates/mehasha-cheat/images/ 18 KB
19 KB 163ms
163ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/mehasha-cheat/images/logo.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0b2f0d75280ba2ed31b8216245084da11ee4c98a6bef86f9c0115a8b10d70c39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: "596f8091-4966"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18790
expires: Sun, 17 Mar 2024 16:31:58 GMT

GET
H2 200 csgo.png
csgowfire.ru/templates/game-torrent/images/ 7 KB
7 KB 223ms
223ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/csgo.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

7455bbe1a32f19de9a0924ebebe048f19b698de0ee2928eab70127f069231dba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:46 GMT
server: nginx
etag: "596f808a-1b11"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 6929
expires: Sun, 17 Mar 2024 16:31:58 GMT

GET
H2 200 cf.png
csgowfire.ru/templates/game-torrent/images/ 9 KB
9 KB 84ms
84ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/cf.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

203febb9b424cfe4228ec781f754f00a34bbf06d2ff35f30afc26cdc78b093fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:46 GMT
server: nginx
etag: "596f808a-23a7"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 9127
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 wf.png
csgowfire.ru/templates/game-torrent/images/ 10 KB
10 KB 83ms
83ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/game-torrent/images/wf.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

da9677e66b7412b04816bfdb3e1a4493c1ff46198b1b67511de10425f14c1db9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:48 GMT
server: nginx
etag: "596f808c-26fe"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 9982
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 1702131383_whsrs3.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 26 KB
27 KB 104ms
102ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702131383_whsrs3.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

fe61c169cc9eaf9837294b5ef607b82a6dd5fb7249ac6fa88a308b9fca51f708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 14:15:35 GMT
server: nginx
etag: "65747687-690a"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 26890
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 1702129510_legacyfns1.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 34 KB
34 KB 158ms
157ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702129510_legacyfns1.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0ec066587559bd366b94f1d04417997b780c11738a2059ed04b795917c9704a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 13:45:07 GMT
server: nginx
etag: "65746f63-88bc"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 35004
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 1702125142_screenshot_38.png
csgowfire.ru/uploads/posts/2023-12/medium/ 172 KB
172 KB 104ms
103ms Image
image/png 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702125142_screenshot_38.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0bbbd6aab32bbe175052ebcfbf9a4dbca405c36c10c0917d4788afee96a91924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 12:31:29 GMT
server: nginx
etag: "65745e21-2afa9"
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 176041
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 1702123667_neleic_sdyu.jpg
csgowfire.ru/uploads/posts/2023-12/medium/ 18 KB
19 KB 158ms
157ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/uploads/posts/2023-12/medium/1702123667_neleic_sdyu.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

82a380c3067da3fc11fbd3dc9cc83d07fb299ea449303eea2ef63c1ca025f79e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Sat, 09 Dec 2023 12:07:09 GMT
server: nginx
etag: "6574586d-49bd"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 18877
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 jquery.js Show response
csgowfire.ru/engine/classes/js/ 84 KB
29 KB 102ms
100ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/jquery.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-14e4a"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 jqueryui.js Show response
csgowfire.ru/engine/classes/js/ 92 KB
26 KB 94ms
92ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/jqueryui.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

00c58a2a9ac9ca117e8bcf3cbf4abccfc3e6ed5d290a418472868bc99d037b63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-17080"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 dle_js.js Show response
csgowfire.ru/engine/classes/js/ 30 KB
7 KB 96ms
94ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/engine/classes/js/dle_js.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

d04ea94beeae5f5242d38763ccb0414f605ff15cd268edcf995b918c21ee1fe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 20 Jul 2017 19:40:01 GMT
server: nginx
etag: W/"59710711-7630"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 bootstrap.min.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 36 KB
10 KB 158ms
157ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/bootstrap.min.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-9004"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 libs.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 2 KB
956 B 169ms
168ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/libs.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

7200fd40cdaedac3fc077156991ef36cde3bbb8d0ec67a828a6c76e93a3a334d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-761"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 slides.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 23 KB
7 KB 185ms
184ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/slides.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

e0e2bc4e1d3ee5024c4e1aa58a6cad9aa42fc63a8c89ce18013a1c8f2b94875c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Wed, 19 Jul 2017 15:53:53 GMT
server: nginx
etag: W/"596f8091-5d52"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 jquery.cookie.js Show response
csgowfire.ru/templates/mehasha-cheat/js/ 2 KB
1 KB 187ms
186ms Script
application/javascript 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/js/jquery.cookie.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

a04d373be23a3f37dfe1f88cab01061db75f716edadc6451c652fe538f4be6c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Sat, 11 May 2019 12:30:45 GMT
server: nginx
etag: W/"5cd6c075-653"
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public
expires: Sat, 15 Feb 2025 16:31:59 GMT

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 204 KB
71 KB 302ms
113ms Script
application/javascript 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

43921e4f993f114268cd47fca552c84f2398b82ab32ce097dbfbfe106a6c3e4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-11844"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 71748
expires: Fri, 16 Feb 2024 17:31:59 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.2722234962049006
https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.2722234962049006

230 B
716 B

71ms
71ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.2722234962049006

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

dc7001717d22c08ab01f83965fd8074695eccfc224f6763c2718a7fa43804a84

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:31:59 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 230
Expires: Wed, 15 Feb 2023 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:31:59 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t14.5;r;s1600*1200*24;uhttps%3A//csgowfire.ru/;0.2722234962049006
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Wed, 15 Feb 2023 21:00:00 GMT

GET
H2 200 code.js Show response
top-fwz1.mail.ru/js/ 44 KB
19 KB 282ms
94ms Script
application/javascript 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/code.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

384d11b1b10a5836bf06f7b8f893cb49986aaa44d296510c250e72808af39874

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
last-modified: Thu, 08 Feb 2024 11:29:28 GMT
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
etag: W/"65c4bb18-b0f2"
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=3600, private
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *
expires: Fri, 16 Feb 2024 17:31:59 GMT

GET
H2 200 top100.js Show response
st.top100.ru/top100/ 122 KB
38 KB 237ms
49ms Script
application/javascript 81.19.89.18
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://st.top100.ru/top100/top100.js
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 81.19.89.18 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: 9e32b3e7468041792a79afb17e71e9375b1319c03ace7c8a1b511164a5265197

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2024 13:22:15 GMT
server: nginx
x-amz-request-id: tx0000000000001763728f2-0065cf8bf1-783970ff-default
etag: W/"98beda959dac7c352379d397f17ea310"
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
x-rgw-object-type: Normal
cache-control: max-age=3600
expires: Fri, 16 Feb 2024 17:31:59 GMT

GET
H2 200 luxfon.jpg
csgowfire.ru/templates/mehasha-cheat/background/ 527 KB
528 KB 186ms
186ms Image
image/jpeg 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://csgowfire.ru/templates/mehasha-cheat/background/luxfon.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

0e53513be2614c96fc5198c93a22a25d9ab13e6f2d34b5e1fa6fd30d963bbf0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:51 GMT
server: nginx
etag: "596f808f-83dfa"
x-powered-by: PleskLin
content-type: image/jpeg
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 540154
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
DATA 200
OK truncated
/ 198 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8a29a2e2406de60fe661af13cf8acbe533af5c4489a8fdb6fde742c3689b933

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fontawesome-webfont.woff2
csgowfire.ru/templates/mehasha-cheat/fonts/ 65 KB
65 KB 165ms
165ms Font
font/woff2 31.31.198.184
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://csgowfire.ru/templates/mehasha-cheat/fonts/fontawesome-webfont.woff2?v=4.5.0

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

31.31.198.184 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

Software

nginx / PleskLin

Resource Hash

ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://csgowfire.ru/templates/mehasha-cheat/css/font-awesome.min.css
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 19 Jul 2017 15:53:52 GMT
server: nginx
etag: "596f8090-10440"
x-powered-by: PleskLin
content-type: font/woff2
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 66624
expires: Sun, 17 Mar 2024 16:31:59 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402120101/ 406 KB
138 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9323971679203656&plah=csgowfire.ru&aplac=true&bust=31081168

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43f29b20b4eb4126ec3ca4db6211c2cd79d95e6aafc00fdc8b70b623d2b5a835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141089
x-xss-protection: 0
server: cafe
etag: 3953929261034323243
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:31:59 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20190131/ Frame A8FC 9 KB
5 KB 28ms
8ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 43863
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 04:20:56 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 04:20:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 14C5 412 KB
105 KB 820ms
820ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&adk=1812271804&adf=3025194257&lmt=1708101119&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=164x945_l%7C164x945_r&format=0x0&url=https%3A%2F%2Fcsgowfire.ru%2F&pra=5&wgl=1&easpi=0&asro=0&aslmt=0.4&asamt=-1&aseiel=1~2~4~6~7&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119247&bpp=2&bdt=407&idt=176&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6775510008283&frm=20&pv=2&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=193

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9323971679203656&plah=csgowfire.ru&aplac=true&bust=31081168

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1469fb8de6c46c160b5dcbe88f7719290ff43d872125d58b46a3f636a14ebbdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 107039
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dyn-goal-config.js Show response
top-fwz1.mail.ru/js/ 3 KB
2 KB 51ms
49ms Script
application/javascript 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/dyn-goal-config.js?ids=3016302

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

90d4798cfeacb30022d6f8efb927da957733d8302ed75b0691a9c4afc8d9f15d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=600, private
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *
expires: Fri, 16 Feb 2024 16:41:59 GMT

GET
H2 200 counter
top-fwz1.mail.ru/ 43 B
1 KB 49ms
48ms Image
image/gif 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/counter?_=0.8762281918863424;id=3016302;u=https%3A//csgowfire.ru/;st=1708101119270;title=CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5;s=1600*1200;vp=1600*1200;touch=0;hds=1;sid=463a80067ae1ae75;ver=60.4.0;tz=-60%2FEurope%2FBerlin;ct=1396/1399/1399/;gl=u;ni=10//4g/0/0/;lvid=1708101119448%3A1708101119454%3A1%3A28675c47a60d3b6fe70d9ebf2d5e7a40;visible=true;js=13

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

ec2-54-170-147-129.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
489 B 76ms
55ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86d840b5de2e0b53155271240133c1b098464bd233a8c6d90e33c2932850a346

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5AnjOKofvF5wli0pndgCBTDGquL2GxafsEyBAVw5YsDspxPXsXO8wVErPR9AnMKOOJXmB4KQ7HhO6b6sB85oyI5lqdqu%2BgZ1H9TmY4txUZ3S%2BUZ%2F6JUAep0f2hCW3hsKSc5pdBZTFo81"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1ce9d51c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H3 200 11gku.json Show response
newrrb.bid/ 9 KB
2 KB 73ms
54ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ae55d686b61da5f72254cb18c100ae3f37dd29d11c5d1adfd6a1b2b895a8344

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KZGGZ6IyJ%2B5GtpBOvRDifNl4LWPylIzaE%2FoFI7WdR1n9ONOkRhB70nYVMUHyTt%2Fnq03v%2F4lldbhVOfZs1BwLk5AoH4rdKIUufULKMNziYzWdrJbpxCg9h2%2BBrub0IXhPhF60tXl0YTMc"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1ce9da1c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 userip Show response
kraken.rambler.ru/ 13 B
464 B 260ms
68ms XHR
text/plain 81.19.89.16
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://kraken.rambler.ru/userip
Requested by: Host: st.top100.ru
URL: https://st.top100.ru/top100/top100.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.16 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: f1244b5029aae8619c8e0abf4c4eea16b1cdafc804705ec08b233e77a0051a2e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
server: nginx
x-srv: 0kraken-prod0002.ad.rambler.tech
content-type: application/octet-stream, text/plain
access-control-allow-origin: https://csgowfire.ru
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-store,no-cache,must-revalidate
content-length: 13

GET
H2 200 usability.js Show response
st.top100.ru/top100/3.15.7/ 14 KB
4 KB 49ms
49ms Script
application/javascript 81.19.89.18
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://st.top100.ru/top100/3.15.7/usability.js
Requested by: Host: st.top100.ru
URL: https://st.top100.ru/top100/top100.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 81.19.89.18 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: e15b6a5399b3a0165ce5553baeb68d5438f0eb9fcc94abd49a54ada8cf230724

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: gzip
last-modified: Tue, 13 Feb 2024 13:22:15 GMT
server: nginx
x-amz-request-id: tx000000000000176387e59-0065cf8dc7-783970ff-default
etag: W/"1d932fc58e5bfcdf5e65e28466bdf992"
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
x-rgw-object-type: Normal
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10281.f4z8yTHKZkYztreO6QJ5nGq8pd34K7-RqKP5KcVnbkQ9tWjMW44QluPZBxjGoD1I.1_2RyH6cG1_Mcqom4QDJAacYzns%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10281.KTDvaxuepcIJSHEqvRN3O8mZHb_m-E0qXGoXXfUFols3QlQ8rmxrlGuc_34aDWvZwhDwFdf3zno5j-twEoS0AZuIvv-ldwYEYL4esNvVMJCOPoodfkXjhOLOJ2qjqDkvwAcTaLzH4B...

43 B
480 B

58ms
56ms

Image
image/gif

2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10281.KTDvaxuepcIJSHEqvRN3O8mZHb_m-E0qXGoXXfUFols3QlQ8rmxrlGuc_34aDWvZwhDwFdf3zno5j-twEoS0AZuIvv-ldwYEYL4esNvVMJCOPoodfkXjhOLOJ2qjqDkvwAcTaLzH4BwEybYWn2S8laviL_pzPIGhoEpdDbcjQabh6XXjkaKqAm9_iYHawEaeaq8TLLgZARBz--IvsGirawmpX9huobA-3AQiykHNRnM%2C.EcDyG_VqL7jDKo_hk29KAmhOkzk%2C

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10281.KTDvaxuepcIJSHEqvRN3O8mZHb_m-E0qXGoXXfUFols3QlQ8rmxrlGuc_34aDWvZwhDwFdf3zno5j-twEoS0AZuIvv-ldwYEYL4esNvVMJCOPoodfkXjhOLOJ2qjqDkvwAcTaLzH4BwEybYWn2S8laviL_pzPIGhoEpdDbcjQabh6XXjkaKqAm9_iYHawEaeaq8TLLgZARBz--IvsGirawmpX9huobA-3AQiykHNRnM%2C.EcDyG_VqL7jDKo_hk29KAmhOkzk%2C
date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
359 B 117ms
116ms Image
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Fri, 16 Feb 2024 17:31:59 GMT

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 154ms
73ms Font
font/woff2 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
server: nginx/1.17.9
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: 5cd31f58a448f673
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Feb 2025 22:19:47 GMT

GET
H2 200 3c2b2226daae872c17c1.js Show response
yastatic.net/partner-code-bundles/968287/ 60 KB
15 KB 222ms
142ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/3c2b2226daae872c17c1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

16c13f0ac60fd3e5c6c568b44f49a7a80a3fc5dcace20789573805149028eab2

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 15041
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "f61632cdfe783d0404d38ecc36f4753a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 15 Feb 2054 23:03:57 GMT

GET
H2 200 37e5f51b4d53831a21e1.js Show response
yastatic.net/partner-code-bundles/968287/ 24 KB
8 KB 221ms
143ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/37e5f51b4d53831a21e1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

31593a6ddfdcfab4ba369674952f6ec9756716cb94ce1fcb9e277229e62385e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7948
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "a73a0ac4cf72516c1448f7b707094850"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 15 Feb 2054 23:03:57 GMT

GET
H2 200 704c5936420664bb22cb.js Show response
yastatic.net/partner-code-bundles/968287/ 573 KB
108 KB 177ms
99ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/704c5936420664bb22cb.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

b9007ab2385a11402abc017721c772911f679ac551cdf1a34b4800226aec25a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 109484
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "ee7f296ca4fdea2df4fa84662a56fb00"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 15 Feb 2054 23:03:57 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 221ms
143ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 15 Feb 2054 23:06:35 GMT

GET
H2 200 1534741d97ee1b3ce68d.js Show response
yastatic.net/partner-code-bundles/968287/ 118 KB
25 KB 221ms
143ms Script
text/javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/968287/1534741d97ee1b3ce68d.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e2dbfcc5fc05fe5eeead963a176a2ee330b1d474fa9505ab77b9fceb8ba96fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 24662
last-modified: Thu, 15 Feb 2024 17:18:16 GMT
server: nginx/1.17.9
etag: "0f344ba4a7a3e401679473bb109ae444"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 15 Feb 2054 23:03:57 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
492 B 52ms
52ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e24e0f68ea2e87b3d743ab6ff847314d13ded8be6807bc2a20cdec6399787bbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WQrOKBCzxAD0m7JweTtUNlML6as2RU2sBz%2FON37XJayNFKhUVhr%2B1VuWD%2FnMLssXDsyXeSbCa6JBl8JloUr7XLJYeaiQkM5Uvhxm%2F%2FhubPK7p6in7Pcrj42VX7PWCc28mVWaqcUmukQk"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1d5a711c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 57D8 22 KB
10 KB 790ms
790ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119581&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c7c531dcaed917fbfd1b789b222659a92880c106af138f888925c77d504a581

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10212
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
50 KB 64ms
49ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9323971679203656

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8178221306ba9a8411b0d2fb6fdf14e114fc6da0400728c8e531a29527780882

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Origin: https://csgowfire.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51259
x-xss-protection: 0
server: cafe
etag: 1997466263556654161
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Fri, 16 Feb 2024 16:31:59 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 222C 107 KB
40 KB 578ms
578ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=400&slotname=6030359217&adk=2207947559&adf=1824335906&pi=t.ma~as.6030359217&w=240&lmt=1708101119&format=240x400&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119592&bpp=1&bdt=752&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1146&ady=1879&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ad258c3ece4bcdd3d52edb0a4ca438452cda6ba3fb9026f73b31fc79d5f870c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41068
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
493 B 38ms
38ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

384f2947a98e8ef056f284e24daf82d7ff711053bca5803d685a410f2269fd11

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CPr%2B0iGmc%2FSAHJJc6zNxy9wjFnsGhv%2Fg2EwE8VeuqsKVR92Tm6dxF0i%2FXtcOXsQRr5%2B1Glr%2Fq0GP1YvlGggjcoPP928K1asgSRJAdDJPXMh4T%2BNcBqoV4D0O12XLZoayUIXMPCKMpu8B"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1daaee1c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
485 B 39ms
39ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1eabe9ec67ba4e31b96c07402c5011ad5c37e9212dd46c31e29e90485067052e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cA9zwAhUwWhFEoOceigmDzUqfnffhJS0NiaD%2FUr2FbX6nPRh5PKYpdvbVTkRHiueDJs1olfumq1wueM8lsIsDfNb28FvzV927OA9HuQ6BF2iU0KhWthk3yV%2FTmlpplfASGA2GeMF8gAm"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1deb591c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9C3E 22 KB
10 KB 676ms
676ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119672&bpp=1&bdt=832&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a440e1d92bc34b0fa669a5330f0d007290217b3c019ab5e3fdb0fd473269ca2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10287
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 443C 22 KB
10 KB 637ms
637ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db442ed0e476f2760c537a9f6fb9a87eec274fe6d762e6ebcfdc961c487e4e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10203
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
493 B 46ms
46ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43ade42b3fee6c4cf815709341febc493d4c6f3bd3d8c9889b5237bcdd4399b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FqFjAXnNuA4fxYYVL7FK0YMRRyt4IDvO54fAdIqcTEA%2FhqkGE2nqfF80e1CK%2BwdwKVDV9YhY0A9WYk1AG5g6HE7n5ABs7zWKxfya5nPgc%2BtyxI%2BUFsTMlxeC94TFNEc%2FIgKrwbF4Qpq7"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1e4c3d1c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1D24 575 B
322 B 378ms
378ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=616386683&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119730&bpp=1&bdt=890&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=5&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3b1cb9968d195ebeee305ed866587a19a95d0dab0f4242ee00bd3102e32f84e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 302
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

1 Show response
mc.yandex.com/watch/39385800/
Redirect Chain

https://mc.yandex.com/watch/39385800?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Al...
https://mc.yandex.com/watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3...

501 B
607 B

55ms
55ms

Fetch
application/json

2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A0%3Als%3A1606409500265%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173159%3Aet%3A1708101120%3Ac%3A1%3Arn%3A483530148%3Arqn%3A1%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C134%2C226%2C1%2C428%2C0%2C%2C430%2C3%2C%2C%2C%2C1296%3Aco%3A0%3Acpf%3A1%3Ans%3A1708101118049%3Afp%3A1148%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace%21%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29ti%281%29

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

58eefec8129f9aac5a4c707518ba65b59507750bbe0116b7a53bfd5ecdd82f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 16:31:59 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 501
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:31:59 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:31:59 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/39385800/1?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A0%3Als%3A1606409500265%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173159%3Aet%3A1708101120%3Ac%3A1%3Arn%3A483530148%3Arqn%3A1%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C134%2C226%2C1%2C428%2C0%2C%2C430%2C3%2C%2C%2C%2C1296%3Aco%3A0%3Acpf%3A1%3Ans%3A1708101118049%3Afp%3A1148%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace%21%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29ti%281%29
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:31:59 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1418 25 KB
11 KB 550ms
550ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5773a5ae20c908911559e56902f3d1dd3f6fb691d2a3a0881b8d41334ff58f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11214
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9EE3 575 B
323 B 567ms
567ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1876635918&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119751&bpp=1&bdt=911&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=7&fsb=1&dtd=2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ef5ae5714190fd1d0879e4f80d2c429e1da96a327cc9c320725a2b872a49bab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 303
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 metrika_match.html Show response
mc.yandex.com/metrika/ Frame B85F 2 KB
1 KB 66ms
65ms Document
text/html 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

482625f9d55feac9a3187b21e5a8ac098bdfaa328a094f7b4dd2d24ba59056e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 862
content-type: text/html
date: Fri, 16 Feb 2024 16:31:59 GMT
etag: "65cf573e-35e"
expires: Fri, 16 Feb 2024 17:31:59 GMT
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E768 575 B
323 B 969ms
969ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=1742413158&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119759&bpp=1&bdt=919&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2640&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=8&fsb=1&dtd=2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ee575a5c18795d9af93c61b1802a61ddf9653c18a60d507a1782bd7bc0ba362

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 303
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4C8D 575 B
323 B 899ms
898ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3885048902&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119766&bpp=1&bdt=926&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=9&fsb=1&dtd=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

461d562f5eab2c3056b17084b9cbe7bd00ac0ea1809675eb6e47bf56a92f0b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 303
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2961 25 KB
11 KB 631ms
631ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca5c73fa2dae3ce27e5060a0fdf2950cde11c48fe716fbdc165859c5c709a3b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11212
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
488 B 41ms
41ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9754e66a7d92ff1137f966824b0b32082a650ef6caa77dc63f60a66d696d2101

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qYFqLe8Nf5G08umSRJr5AjVAqUy5aj%2FoQkUCP9obtkd%2Bvni7z5WyRjzoTfn24BOs8lNrWLJOXUiffoBSmfXkQIHwh0WmrTM66AFgI%2BkzasdXXrB%2BUBwUgXsupbnNczCn41twmtJMsgUD"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1eacd81c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DFA6 25 KB
11 KB 668ms
667ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09fe21a220996bd2cac72011e683677f7b82178533b39d3ffec79d34875b8bf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11251
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 44B9 25 KB
11 KB 574ms
574ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119789&bpp=1&bdt=949&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11b62092d5fbaf77077bca0baca5e81e36e66f6ceee9073914306f8ce79c5aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11228
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
kraken.rambler.ru/cnt/v2/ 43 B
698 B 211ms
84ms Image
image/gif 81.19.89.16
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kraken.rambler.ru/cnt/v2/?event_type=base&event_name=page_view&project_id=5753332&session_id=19005556_1708101119519&session_number=1&session_event_number=1&version=3.15.7&counter_type=web&experiment=%5B%5B%22exp_ws%22%2C%22no%22%5D%5D&top100_id=t1.5753332.1891670330.1708101119518&adtech_uid=410d9986-9d1a-4221-ba7f-902ad7ff5231&adtech_uid_scope=csgowfire.ru&fingerprint=pA8AAENKs1cCoPNZAT7WYgA%3D&fingerprint_ip=pA8AAENKs1fAETUZARAZYwA%3D&url=https%3A%2F%2Fcsgowfire.ru%2F&request_id=1708101119.518-1671281840&event_id=970211197961516&meta=%7B%22title%22%3A%22CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5%22%2C%22referer%22%3A%22%22%2C%22screen_size%22%3A%221600x1200%22%2C%22browser_size%22%3A%221600x1200%22%2C%22color_depth%22%3A%2224-bit%22%2C%22language%22%3A%22en-US%22%2C%22browser%22%3A%22Netscape%22%2C%22platform%22%3A%22Win32%22%2C%22timezone%22%3A%22-60%22%7D&rn=1344486233
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.16 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
x-srv: 0kraken-prod0003.ad.rambler.tech
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif, image/gif
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 320707 Show response
yandex.ru/ads/meta/ 30 KB
12 KB 215ms
213ms XHR
application/json 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/320707?target-ref=https%3A%2F%2Fcsgowfire.ru%2F&pcode-test-ids=953764%2C0%2C35%3B944517%2C0%2C44%3B962953%2C0%2C39%3B959786%2C0%2C69%3B967960%2C0%2C46%3B967051%2C0%2C7%3B968857%2C0%2C0%3B962776%2C0%2C50%3B964924%2C0%2C51%3B962909%2C0%2C29%3B962763%2C0%2C39%3B962781%2C0%2C90%3B892904%2C0%2C23%3B962788%2C0%2C24%3B962799%2C0%2C50%3B964643%2C0%2C97%3B961173%2C0%2C25%3B940996%2C0%2C39%3B964642%2C0%2C66%3B968902%2C0%2C85%3B965054%2C0%2C73%3B968287%2C0%2C62%3B964903%2C0%2C58%3B681842%2C0%2C29&pcode-flags-map=eJy1Wdty2zgS%2FRc%2Fx1neScwbRIIS1iTBAUErSiqF0iauGe86zpbjzMxmKv%2B%2B3SBIiVQWspPZPDgSJRwAfTl9uvXnxTXtdLcRW00LXdEVq3QppOaNXtGmYfLipzd%2FXvy2v%2Ft8c%2FHThZI9u3hx8Xjz6ZG%2Fh%2FdJEoZRevH17YsDTCtF0eeq06LRLe075kRIfRKFA0LBO7qqmM5F3ygtWcElyxWchLatGyPwoiiYTgFb6rqvFJeiqgCtUfiCSb2lKt%2BwQiteMy3KsmPKjRsGXnq4nWRK7vBWDVNbIa80k1K47ZPGSZSSCQF2z6%2FAyDvRK91VAv7w10yv4MIFlZx1brA08yPfgOENEKOVzFzycN1rXjCh7eczON%2BDfzM8EpLUO4O36ssSTMfqVu10xWu%2BBH024nVLefHXn7Ds4fX3ojYYq3%2FxSf8H5g%2F559uY%2Fz8LfK%2F3MdjXkq50xZq12swWQbJmx8syL%2FPSaFrGGkMCSlJIlWve9bQaeAVZib1STDbwpOjclJD5QeJ9B6h50NGS6VLS2k1dZo%2BBHqREnungG0BYsKFCMm0pQgB2Z1BpX3Chc8mo4tdnUj2LvMCPp%2BOPTlICSKhTVCqkoZJL2Cjf9M2VLimvZojx3ONZFKTBAZAqhT7tnoMYugDhrsC6ecUZUHfF1mBN3pRCbzfcMHpzzWCLIfjRPmduH3tZdsS7TQFBSFdoAlogEu%2FgQS8rPPSWrcQ5a6ZedGDhNYM79p0Stb6uaTtZ95pW%2FdzjySJvsiQOk0OhYTlA5IoOQVPTqnIfI82iKDpdbVbqLVcbrSAWn4Mx%2Bq7uFdQ1MMZpSYpny0nge4lZ3oFVtS25BYar2rUMy34rtkyysuQ5ODPfzcBu%2Fvj3HG6WurQoxkxr6RpKbKs4ZMWQCBhqxtwVb67cdySE2Do3lvOGGXkyJg%2B63nUu4nugCQxCm4uC%2FSBGB7wA1NF0FUUzg99a2sDNAM6NkCVZMCEYWsCD7CjE8ytNG%2BfiwE%2F8A5mWHEKk7VcVzzXtQLh0z%2BNDEkZZkByEWi%2Bv2c6cZrNrN%2BA05eY6EseQlIf1yngZUrEDO8xWkiT242i2NkmThMwknpV2eSddNoiJD%2BFuFpqSNAhS3Te85OAH3sDlS5ozN0YWWA2HAQCBDTmz0ZVY89y1LvGzMIlmhwZrSQjrRlkdh%2FW2g3Bije4W5j8BI77N2hxzXTQjp5VwBc1NrYEz0YI5IypJM2Itia4rQTI2RbUbahXm7lIpu9evroz%2BHEJp4GbAgPBeCTcKiWzdQ5SKQVYBQu1ck2RRMuT0kdnWEvRVwborJdznzpLID4%2FtZ3gOqguAHOE1oKih1pR83UP7AOoF24icQbY7zZr6XpTGYyEfwkT1srHugaoG3lYbKfr1xpklqe%2BPhQZIHXj55571DLK01asKpUfF56XvzcWH%2Fe3dy4fPgPKf%2Ff37mz%2Fg9d9uP%2Bx%2Fufk0e%2FTL%2FoN58v7Lzf3w9f1vt48fh5cfXh69eX9%2Fa58i8oQADx72X%2B4%2BfvnVfvzlYfj%2F88P%2B5f3N759OvvDP%2FccPt2bp29kVY0ioIZ8GHq2ZXOPfglOt6LpzWjoMAhsGJoAZeAn4ODd1wr0wDj3LpVC%2BC1ZSYIShzDR9vWJOIkljP7TK1HSkpqfEAgVNLsuH3AFVyCHLz8CkXjwROi1q5JG1IQdelPTUvTPLZXFMLIXOcu04gpXo880Qx5XozAmHCi%2FZ34Exz8QxpEk06KYdFBtwTz6YeFUJCD7INZBjin0jCuUlvwwi4oM2v%2FQB8vh9sHgfLt5H5j29DGLoM9LArqeXcYYpf%2Bn704MEgifFDY7Nknkk8YfKVHKoigVtTVgNnXG%2FduoPqDRxdJRvKO14jUGBDhoC1AkQ%2BxEZAMoOnCmgAeCv3CvC0FKRjX%2BIXmwnkAGpUdE4cYDCDCnR9G6oiFiFsaGyMEJlQOkgwBXNN87VkEtJMhW2das0xBBv1blFZF7VrFjPUf6jjJ1XsjeEYManwQsCF4%2B8MHmRhAToMoxnTsxCL5zsaBl9VJcagk7XFKUleMatJ30vI2dSxOj%2FHDWPMImCqlPy9QZegaKtWKmGBo4CsZzZLAl8a8BeohEwcpw0hGuycGIAGwHrIXXR50abOXWd58VWSFmpPDZHogUQqVZQiamGOlQucnT0BKCNvpglEvGChPjT2YY0WO20hEMKO41bI1HNbvgmhB7W98gcCUSTN3pTsi1EJxsaBLdkDTxvoB%2Br1HhjtkTGpZVRqsZeYgVKCu4M1AaHY2tnjwGosR3uWdE0iWnTMmHwYzNbLSXsCU4YxIeGdZpvAhzqaKf%2BgLVRnM2HlEYUGLGBGbtUwScAcWjjBo0xgoydJyZeIfK%2BRnE5GmUykxsYe2WXoiuB1eS5TgW42z%2BXd4g%2FTQpMteQVV9MxnfihF2e27dyIviqGWZWx4WDNsSkzuvx4V%2BASvm4O6lSt50m9v7vTHx9ub%2B4f94%2B3H%2B%2F1u7vbd%2F%2Fa%2F%2BPuZr5%2FCM3Y8f429043mknh5WYn15pgi9ejha5YxdS5aPCzwDZEVshAFIDfGbTJy2Q5svQUGexVXvVQLWpJudux0MPYOdJwOKgP4gpvi%2BedNnVDpB459PimZQSixcoBjbzNAzPfKlTfnAmDNLBpZIY2qEggljbczZhhCtk38ZrpBIGUQFp3pqy4u%2FgIRIlVF0p%2FixeplNRNQJGfxkPumo6zMdmOA8RBYZm2zfxgcqYLJHGUBtk3gGxf31LlrPhH64%2Fk5zjKOrt5ElsGqsUKh3JdMWthcX7JDb0%2BpXiSKAIxPEXFIXztZKGgElsmthihvnu8m08GAmJNezSVsBfasgo4iOnhfGemEyS1%2FEILuNeSNAm0rIk339k8mUYLOZS4bkz82g6v3EeHVsC3ZakWWNUqO%2FIF9pVwfhuic5Bf9w%2Bfbh7nQFkWHw0o6vZIA1%2FxI72DH0NLuySXU5umafIEvCeCYKjlohLYUEuxda8CQTtXl7RXAj2IPyagPOsqMPEwep8G5ouB5TdixCOO%2B2yE5K9Bcj%2FLQkn4JMQfgoEsq1YCAuscSuY%2FBeUZt7OAoxO2vAChBMJU8WbRny8WZwSMHTlO0%2F3cAzWc3T9zQCyDaMkssJ6Q%2BdT0MHEdfxXuRg11Jh6TKDzOUSuOhvTsWohAhuNEtXPD%2BH4aziX7YQJsispCP876fhJ5hCTzC6FVnnqpE%2FvApQY9zOsWe3pQwSgiQXbgb03utRmxUxToL9dYBaHxE1f8jBljz3bZZtWGYcF74gozfz%2Fl4yzI0sXJ8MnXt1%2F%2FC5Yvg94%3D&pcode-active-testids=968902%2C0%2C85%3B968857%2C0%2C0%3B965054%2C0%2C73&pcode-icookie=ar6Naktcsqi1%2FkdCrabb0EZ9CP3a6wsAQAp40NZ6PHwd0zpmAJ8HeByw1lUtwa1NzVXL%2BzKQg2C%2Bc22pueDOjxOwkmw%3D&duid=MTcwODEwMTEyMDk5MTk5NzA2MQ%3D%3D&imp-id=87&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=333701779030018&ad-session-id=3464831708101119808&target-id=31887993&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fcsgowfire.ru&top-ancestor-undetermined=0&pcode-version=968287&pcodever=968287&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A160%2C%22h%22%3A0%2C%22width%22%3A160%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A0%2C%22top%22%3A0%2C%22sspInfo%22%3A%7B%22deviceSizeSsp%22%3A%7B%7D%7D%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=5120&grab=eyJncmFiX3ZlcnNpb24iOjJ9ChKkpJDkOOqBEFDnDjb5tzZt0I7zunmVB3lZSZ7YigWbUzdqu2cd7duapIJtO9tN3jq1YuvOo9gV0hes_rUdpdShAD0RwBVGMhETjVZ0LMnXpfvxNiJmzMyYQQxiNHNZ6BS0WmYWuiTVM7ModAptwowSPmpkiEwVpSpWKpHrVImpwktVyFNDwlkDQAShT1GNNZAEgkDqk9UgrIEoED5QggcY1YdH5csHOAv79GOhTRRp1aS0CbhmfaI0qHRqhS7WmKsh1igSjQJcc0AcCF4gRSALxM339yc01YDYp3qQoge43DUsqEH4IKJA8CBAfrF4HmQQDux7Un77KMB72EB4CAQNCfILFD-AokD2ja6d5JkTiH2Sp3dA4FPVpkNTJy-9md1JcTgJNaxYpVfmdD_p7FM3xlhPzcyi18FeAFaDNlUqwTWftFSnSVRmJxxVDMtsl6g10uqN6B9WWmBqY_pYQa1OHiZ7-gB5mqxgdI62yiRVGegY0-OOIVbRPjNpFIpYwwvByKjQvGRdgc6QVobUOFCON90DHFEPetoO67myG8MLpdEWeJoUtvGprzvOtR7felWs1sewNBnFPGlGGuXV9QnFB_2IoQ5FtLprz8yiVKce1el0en2iMWp1GjjVFaBK6HVKxTUPQFwSif754f38QYT7VMKHQeGTPkwSFvZr1_yz02gdFLRTCttE9eyeQvDCNN65VwZvDVv-F0-bqpVJLaBtNTu5D27GpehPDZD_E7KnmPCp5aAczuKAD4i-ul_hEVV9yoDQJwnwfVIst74UOh4uFWVYEhcOAQdCn-x32ie_qffJsNwa6jOF3wtOsE2jTwrSbhfw9_sEyzhRILI3Aah__7Ok0qaqexwjK0ar1MBwZGOEqTSysdqTSKdPvPtanzo1GH5_f7iMOo3HN5vZQrIDztMt0TrgXjW_nCA0iV5JQft6_NB9_Y4Ifpu-AnKrfJhP6TRmt873pyHgdEiXuYfigvm_tQaA7DUQThevCFlqWAuaSfGWBosieymwJfYYxqTSATHWpBUBwoqzSMj_jY-2mL-mkn0Q_1pjwlJnG7Uu3kK46MpaBwpiFPA4PQG4dkYGNlNFVxFp_vWJ1wzLVQ0A-xlL9KX_SOVTchdWooX0SQLii72SflHPfScsdMI2p5A2Egi3KjIfDJz-6_ntuRMNbE-LECygIYMQziD8dwholAorCQO3RWcOcJg5jyjh546y7fDWrFiyk38KSK4kfMfg-KD34ByXOLDV8yixwl5n53YLv97AtvP4eyGw7A0hURrXXjYPK-TyLlw7g7h8RZPY-B9I5PtAQlw64xYQ2QF8wfdeyH_GPD2-9MIx27EfinFiirN_xqTxl3JosGNFojS-G_SkLbv09-z7q5bYl_vkPowgQmVv8oSeMiZa5qwuAzuTVyTPKHKD4F2Om_QApDZK10l0yuQt6FCXMX7vgdZRincDjPSqmEZttpn4D7keJOUJ31t_9gluIP4DngvjfbcY-Lj3xqpkJ-HxGOO8tGPUxgY4cA1a3ZucSrj0b1k66DVWeQCYJTDyYcPtjPiJ6XN6ZmnJBjVPj-uo_IaG75GongsPNFfLd009uCpGS8eAQQcz0T-RwzRbw3n4Zhyb4lb3dtPAs7lpZdmnaK6DeUHn9tMWeXcfnWk3kdpS4t898qF_Tke3dtwlSnbPRFOSHcd3zwIRr0TZcwfGuF3jjKXOce3T9xNtVLCyWKwdlH20kfZdieqCMsaGJC3wYdHpFElVp3q9TkNvtDkQHse8fGrpjei3CEpaI1puHgJdrFIoFbGKmisMo442pd8vptxtgVxSn7swN7W0Xm3u87nrFR5SI3wmsJkQI8p5VzMHUOqqnCXVl68H7lOO613M_o2NTy4kbSKenULK69jnhqRDMf1AlotvT-GyvvkM30P_y1JufqHL3fL1XA_U9T_mE37jZ-7FHogvnKJEofD8rrMG2vEttrNk_W7JyQyrD-p1RV0R0sWJRgdz2IvybQzF6UcBtwr9i13SvdVRGa8Z7WA4Xj0qbE6f-48_K3d6U-GeJyqh80SeLyQdscJd3nDBoH0ShwEeC7saF5Lx9iMzhXII-lTxU1gxgveH_DuxYiiZzV2CIaalvUV7weCjx1jkpNbSaGPVt2klY4_YOQ9nDEf5iXEfWwDpREf-QjSXBdyTnHh1ttI96ZHPC74lrNsLxoG645wuOjyvce8CDZckd2S-LasLe02W-Y2h5LfMvQtSRCgQIwGzgoMCGRNKIN1lztCM9lvRnvH-9Qldn0Wj9bw0x6sj_f0ACp-qvq0qX_sUtINoOup-TPtXkY_DCzUADnMA-A9YxJgeGihLJ6Kl9uco4hhBYoh1WswP_TYh3HyWThjCxHFGnSzAXwdnBS9T1x2ays5Lw1JdOTCW5mjZMAAgzT1jCNdUD3cRKTbN3xL3oZna6vVh3I0Enq4unMo6k_s43OiMvVQ_NlulO-vwFbWSn9KZkllmL5WZwAEHKRNKoGJGAR8hpstqgB80npTiNgI3BPhnjGzoo9jp_83_JCYcS6jQ6mC17S5YU-X7Rcsw_NoY6s-vaT4stPMl7XwqjQXdWFTsW2Aww9FjZANgy3C8guPpaSL_htxzHKQ79Gr1w3ZjM6d-VPi3gcIO3wS5LqoooLlG4wPndimPwSbeBD4G_e6AZH3J0RzKvCs6I7vIGdnvfPao_p07eS2yfBy2FtOzP7RZ_1Yy4qR1302wRxbeZhdWyE3Fx2ov8SQRLdfRlQhiO4IlWG4EFh_XTQuOCowlNBsagFjEtrKAP3_ZSv6ylvxlfSv5M96oViWwzVzSkA1jEYamCENj0xpfZw0NLWOiUhatvjv2zKzLlJQZQ4OhbzB0DYa2wcBvMDQNBl6DsWFc0FmZNClsuAnMTzEODo6cX1a0vPXFctk12w3HwR2bw8Dw0ujYBm82ugjM54l_k1x2Q9agpI9hMawirs0YwjdQoK9R3kMdFi2eTbd2dyhYDizszwML9vXwuRpXzWzXXAgeXDxaC3fmxxp-tm42XfKMedrq_7_b7O58jKjxAETVps9fvc7k1-7jD7hpbckXHBZsqHqGIqBXHNkh2m9cptHN3BTibQIJB--Aw4svF3tuqcndWgpnqp_9rZyvDUo8rKurptqodBUybYMfSc8ArS1C6urEndGE4_QcpwAFvSwk35s2GD4pqhpAycy-b4t3bg6UABJnY_kvpccTlvSELsdntgiPqz3uV5D85_COS2K6qTtV9TkRS9aoTjMgq0UB40N3zRDpLMps1KhbiI5erW8RPqkNndZ92OH5Fks4hajW9ebcfftLQ2pE4u1iClbZTO66FR9rl_LtpH6Tq0V7j6TNgNBR68OxWflGHsWGqbz0qEW5jJ0kFhXSG0vmBk92wKO6RH_fEqy-1nvqHqSQIaH7L_FYACto9Wb4o_88Po--_CtDY4BBW5n267oV6rNDnQ_uJQgLpnjJnYMn3XCVveHlUI5R-6w1Nv6naHymyJaLHOeWRxsu19MXr-a-DHpUW095gWMxZyeQrZyrE_5xsj4-tOWP93j3b1kt2E6LE7-Zj9-olwu1STxd76p8z40IK6phbmHV_piO1Rtm1EvAfetoWblOgWlc99HaEM0WL-h7-a8kq7up1s8-rkCd4Zc2AYjX8rdjPItylLX8LSTBkOrZ8e2yjmpZXEyd61Cs7uKP11GOHhF9_i49ZizxXKt45zvqKkdlb8nGpyBqcn-SfTID_lhVdm5WlWQI2fUCvr5LtPxGvd7uoMvIjcRUo6A11cHU9aYkH9NjP27FtZ6HIHymQS5bLdodli9xCg5XqrrqyDGMo56d8RkX9J59zcPdzWucJR3e-HynsW9FxBZI0k4deXuPhNccuIDYfephTdx4UL5UMOZCHrJ6x7W97254uVSSX2jiJc4t_G6-fNw61xiKNmxS5IMtXM21pDdTMnGXsmfOuf6DHNN5giUa6GtTOd0ZwZ5PPHRjZA5AqVOKCfeoWdgZPY0CExKgcAwWU_sp9_QNLEe3v4h0X-4NAMkQN8Wuy0boD0kEg3V8pefw9BDwUq0WaWqA09Z-5Hzu6Etziym05juL2k0TfleQYgM5CUeHUZcU5A8XUNl9PS2rxemtDjuVkG49v_glwVcYRUY55Frqph3wbdcKy7RDnBKLd5jaTea3tb0IqyPOHPP9rjqJkav8j-35FhSNOy4pONu_RVobYMzfXUlnlrou3lNgg4aXy9LdUM-Hu9NBdPO5FZAlHJ3_D7313rzDfezwMpm40aMRZXgl0d0sy9tRnF-zyP2eIN_cyWH841E6t_Ap2g3a-dhQOAtnrfHbJpRT8fbzJ3B24FoSoNqZ60hVNjgf3XEIN9-K-VLy5VyQCyr2yrd1tCkmaxJd88ur4N4IhKMW0Wz-GTfjfu2tBndrWFnIsJj2-bZmMeUFXFQ5YJ390Ub-CW3eGPtyoL9EYYkYzgU-sj8vl6D4vBfO3dMT9wBFi0Jf5mo7SzpTtGJdWILnRUT-liuPNUuSRGO8d_wWN-NlrnMsKDVa2_dwLi5r5fs41_1cAiFxhRJd-HsHRTbYeuNY3KZvYfBmmsf9s6nS88zhu_TqiR3q7fDeEAVRL1exSlsDXWYF2kQrfE-jV7Njric7sISN8TpIZ88IXoLzbFZUYyOXnWm3KXJ2vK8u2qii8h4rs5DTOuAODN3einI6Us48IyT3bg8NmcBaIVtUUvbTXYE8soHkqFkJuGFZABwd0WjMtnsM_hi2Q-M2VVFNf8Jmp7Cr5npt03i90cJ1VNv7KLbgEt66TLZ5H6tkMNvaMbi5hzFuzXhFBONeW2MiToUyl39yIuLOPb_QryO5zT_ZEOaMRAtk3IJd2fvWWP9jAJJ99SXj24yNV08lKmxM2mXOWPN4zc4SRwsm096XYN2hvegpNjaTxGeYvFgoA2yOVgz_-467rUQ7sqKSWGvoPN-czsW2jPdcNGetD5HWJkyZ92URFvZZ6OXYGEMbEVYxJigKdtcT5ufHdiL_dhBM51A-4NmGhE3i5F3P0bc7PMq1d7lWf30AT40wAUWy7JLNSZxYIq1PsltrTQ-qtZ8p-y6LyIRscEnycF1QV45TkZmH&uniformat=true&callback=Ya%5B6849128842562%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

a602514ec84c940f390b2b7f4ee924cb6baac5ff9ffa410c2759f194e03d6075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101119844846-10613994486139450255-balancer-l7leveler-kubr-yp-vla-115-BAL-1319
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: MediaCreativeReach
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:31:59 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
uniformat: true
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:31:59 GMT

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
494 B 39ms
39ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

833f05646b13b977179060d6d13856ca469d148c364d5c6985b64dee5dc07cdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sUIFL9a8fwmisng%2FsHPcY%2BRp9UrFrVZ5vfzq9zH0CWTAiFFA4%2FarF99bfTCiM3Uf6Oi%2Byu5lbjvxfWJYzcklaGuHeKvjb1yz7TKHj7sioSSIU5%2Bz%2FrQlRrsoI25zMmCpNp%2FifvD5MFiM"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f1eed511c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H2 200 1
mc.yandex.com/watch/39385800/ 43 B
86 B 55ms
55ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/39385800/1?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1708101119_83b8c9b173d36ef010c43ce406052f401b4b8880b1cc720ed333098bec0036a3&browser-info=pa%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A1%3Als%3A1606409500265%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173159%3Aet%3A1708101120%3Ac%3A1%3Arn%3A975637644%3Arqn%3A2%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1708101118049%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(2)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223464831708101119808%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:31:59 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:31:59 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 230ms
47ms Preflight 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://csgowfire.ru
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://csgowfire.ru
access-control-max-age: 1728000
content-encoding: gzip
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
timing-allow-origin: *
x-xss-protection: 1; mode=block

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
52 B 156ms
56ms XHR
text/plain 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2 200 6bcf00fb-adaa-476a-a0a6-254a0f8cf7eb.png
storage.mds.yandex.net/get-bstor/12412581/ 90 KB
90 KB 238ms
84ms Image
image/png 2a02:6b8::158
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.mds.yandex.net/get-bstor/12412581/6bcf00fb-adaa-476a-a0a6-254a0f8cf7eb.png
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6b8::158 , Russian Federation, ASN208398 (TELETECH, RS),
Reverse DNS
Software: nginx /
Resource Hash: 80a826b103cca25ec4e7087b6b80d80dddb2dde5cecfa8f937190a3ea8234e61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
last-modified: Wed, 07 Feb 2024 14:33:25 GMT
server: nginx
etag: "62d306cc76ed2e16f803a1a67946de6f"
x-cache-status: hit
content-type: image/png
x-data-size: 91819
access-control-allow-origin: *
x-mds-request-id: fa63492b4a86af1d
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-robots-tag: noindex, noarchive, nofollow
content-length: 91819
x-mds-tvm-error: basic_auth

GET
H2 200 320707 Show response
mc.yandex.com/watch/ 411 B
518 B 56ms
56ms Fetch
application/json 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707?wmode=7&page-url=https%3A%2F%2Fcsgowfire.ru%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1224999945616%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173200%3Aet%3A1708101120%3Ac%3A1%3Arn%3A992806999%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708101118049%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=mc(p-1)clc(0-0-0)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

29c7df01e651c148ffc00c02518d69677e57a016f11a8362491c14933533f4e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 411
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:00 GMT

GET
H2 200 render.html Show response
yastatic.net/safeframe-bundles/0.83/1-1-0/ Frame A7AE 24 KB
7 KB 109ms
36ms Document
text/html 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html

Requested by

Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.83/host.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=946708560
content-encoding: br
content-length: 6262
content-type: text/html
date: Fri, 16 Feb 2024 16:32:00 GMT
etag: "eb77de48712912aadc9aa8171ac75ede"
expires: Sun, 15 Feb 2054 23:05:10 GMT
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
server: nginx/1.17.9
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
487 B 48ms
48ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6360444276cd317fc2dd61c3210a0fd4152f4769e82e06e21c99dd8b7a1141e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vT2iYFmUjndYc0TRLuMXAskCk1o879FTH8iakiBcQZVWgB4xobc23zEb85oFDa2ZJz8gmZYsygMYlJfdnnTNFIrUBpea5%2F1aFC97kuBx0gYrT0Mt0m%2BO7mGzPEUkZeGnzMyc8BMtBCkL"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f2098471c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

POST
H2 200 1
mc.yandex.com/watch/320707/ 43 B
74 B 56ms
56ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707/1?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1708101120_37a2c950da3c089a8832f7d4777c0247ef3fba81a5cdc2114f2ab10e0c2c12c4&browser-info=pa%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1224999945616%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173200%3Aet%3A1708101120%3Ac%3A1%3Arn%3A553036082%3Arqn%3A1%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C134%2C226%2C1%2C428%2C0%2C%2C430%2C3%2C%2C%2C%2C1296%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708101118049%3Ahsa%3A1%3Afp%3A1148%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120&t=mc(p-2-h-1)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223464831708101119808%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:00 GMT

GET
H2 200 320707
mc.yandex.com/watch/ 43 B
0 55ms
55ms Fetch
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/320707?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1708101120_37a2c950da3c089a8832f7d4777c0247ef3fba81a5cdc2114f2ab10e0c2c12c4&browser-info=pv%3A1%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1224999945616%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173200%3Aet%3A1708101120%3Ac%3A1%3Arn%3A548049899%3Arqn%3A2%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708101118049%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101120%3At%3ACS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5&t=mc(p-2-h-1)clc(0-0-0)rqnt(2)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:00 GMT

POST
H2 200 1IwHhkSE0cO200000000U9nJ_B_sZPVgh-UcXhF49DaQMBTmMFxlFP_A00IUC95GlqlNXMCFFs5XI6K4YcVE4llxgnueNXeEvDLU1HAjZ2b0iXCa2mHC33CPqoT2s0iPJQeXh9MCN9eGrbv61oT-XgDW_bb6Pg38LKQGrhkC338C37yPrSydEizbOWAAB6LQ02JNC...
yandex.ru/an/rtbcount/ 43 B
1 KB 53ms
52ms Ping
image/gif 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/an/rtbcount/1IwHhkSE0cO200000000U9nJ_B_sZPVgh-UcXhF49DaQMBTmMFxlFP_A00IUC95GlqlNXMCFFs5XI6K4YcVE4llxgnueNXeEvDLU1HAjZ2b0iXCa2mHC33CPqoT2s0iPJQeXh9MCN9eGrbv61oT-XgDW_bb6Pg38LKQGrhkC338C37yPrSydEizbOWAAB6LQ02JNCaK0EMUP_WF1AoQ1BNVFx9WbniZGObJhqIJ8nl2N2MH4ApChaEnbLWIIKvavWEHSPf0HAu6a0WE8lv7PeV_1Vf4-KOEJp31VNsK6Mmmcdp9hxV3c-SaCSXpOwImFNwu7ipQm_8S1nXqiJ0UGk1TOMczkUhbjxinRuZTP8DxxOF-GvTTpbLzp0g_QlsK1UN81A-T9rkorl63f2wmADrd_-pxz-MUBMFnNLf0flrWvZGpCZ2miB8qj6jXMVLYNrC7Mm3A1xV_jJTUl7FdtsNG6svN3mGlODjswj7BnWHt_JpAkP8FPS83DumGRyoCstiGALwjaVr_7GXEZ0lENR32t_6JR5HTuFaRde_r4TjcT9ZBJIzxPps9dipIpCB8mty3Ej8ETwGIx-0FsarzVDzzxs7Whz0SxpmAEvukOLd1i-SQuWQChQ0S7uoqEZ51_2WpI1ljUJf3_fdA2Oc01PmFp2ix23PnC5pXPNd0oVk1a_C79k80BQ1O0uwhK0m00?pcode-active-testids=968902%2C0%2C85%3B968857%2C0%2C0%3B965054%2C0%2C73

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/968287/704c5936420664bb22cb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120200164-14609091492925677475-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
964 B 149ms
51ms XHR
text/plain 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 95ms
47ms Preflight 2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://csgowfire.ru
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://csgowfire.ru
access-control-max-age: 1728000
content-encoding: gzip
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
timing-allow-origin: *
x-xss-protection: 1; mode=block

GET
H2 200 14264752799151662701
tpc.googlesyndication.com/simgad/ Frame 222C 86 KB
87 KB 42ms
15ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14264752799151662701?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmrrzsWdHmM0oOuh2exlv42H4Cmjg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=400&slotname=6030359217&adk=2207947559&adf=1824335906&pi=t.ma~as.6030359217&w=240&lmt=1708101119&format=240x400&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119592&bpp=1&bdt=752&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1146&ady=1879&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c50c8277f4d6626c85a12de75c46899d566c85a155d6bd1ed45a19a6e7e0fa85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 02:07:26 GMT
x-content-type-options: nosniff
age: 51874
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 88295
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:11:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 15 Feb 2025 02:07:26 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 222C 23 KB
9 KB 35ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:21 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 222C 3 KB
1 KB 32ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 222C 20 KB
8 KB 33ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 222C 204 KB
61 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 222C 36 KB
14 KB 33ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

473f98fc0967c2c122456fc402d7db00d57d3fe3b46a12d075d10eb26a55dd5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:47:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85462
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14610
x-xss-protection: 0
server: cafe
etag: 17234995959194474601
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:47:38 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1621 143 B
166 B 7ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=400&slotname=6030359217&adk=2207947559&adf=1824335906&pi=t.ma~as.6030359217&w=240&lmt=1708101119&format=240x400&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119592&bpp=1&bdt=752&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1146&ady=1879&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3206
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 15:38:34 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 WV4ejI_zOoVX2LbX0HqF09CRQimGOG-YqOCecsXKAa4m-IRaHZmvAK-WiEqqqZjb4NR8ItrdR2BmUhrUhrUT7UT90iG-XopDdtbqslpmPuIuG-r3cFd1-tIILlPX__1avc4y09Acl3OxBmyt3s9w0Aw9mYhZ9BEnnW1V9Pm7q76gI8-Uk0Wz4rGGn9DY1EeC3fQ--...
yandex.ru/an/tracking/ Frame A7AE 0
278 B 55ms
55ms Image
text/plain 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yandex.ru/an/tracking/WV4ejI_zOoVX2LbX0HqF09CRQimGOG-YqOCecsXKAa4m-IRaHZmvAK-WiEqqqZjb4NR8ItrdR2BmUhrUhrUT7UT90iG-XopDdtbqslpmPuIuG-r3cFd1-tIILlPX__1avc4y09Acl3OxBmyt3s9w0Aw9mYhZ9BEnnW1V9Pm7q76gI8-Uk0Wz4rGGn9DY1EeC3fQ--TheGP9pLM6Ba555E9W9u20kGMN7Xl4IIhn1V9CjsU6nJrnRjoizUaJHC6wYHNa4rumdr8GdEDLmSshq1eWKiQAx4-1904MUNQah37gC89DNzoAYRLtWJk06eUEoO2xX1BQmGxLCuW4wOODoRieqAfi1O240mDD9wJLiVVcYj66GAVDfCjaO2le4xmGp3PxG23EXt6JICcDq3sD-Qc6-CMs_XCWl6hPWkb0gaI0aM4GxD_MyaK-c2N-OWk47qsF_IuzzxmIdhvtWzBCh6dLTrx6q6G1QUlTuJ5jTdkpnef01_VW0BjsBqNzZtgZc-hntAOeK9h7VqhgkRuaYXKdijHxmWXJwhCoP6yNhp1aSfa0mu0egLogLIkiI7cURfYg_4WSR29LAfJ8H_09W7Flrw31-piblZxgddQKEfMkeQARK3ri5oTg-7IXU1AuhVHvhnpCGzUaBp3frEd0gOghz3m00~2?action-id=11

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1708101120224038-10665227787679606369-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

a71b8e26c2db403526ec11
an.yandex.ru/mapuid/arcspireis/ Frame A7AE
Redirect Chain

https://px.arcspire.io/yndx?id=9d4cd41a-f59d-4815-8a89-9d30806f5389
https://an.yandex.ru/mapuid/arcspireis/a71b8e26c2db403526ec11

43 B
293 B

151ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/arcspireis/a71b8e26c2db403526ec11

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/arcspireis/a71b8e26c2db403526ec11
date: Fri, 16 Feb 2024 16:32:00 GMT
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2

200

0500007F008ECF6539034B1102BD7B3C
an.yandex.ru/mapuid/sapeis/ Frame A7AE
Redirect Chain

https://acint.net/rmatch/?dp=151&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F%24%7BUSER_ID%7D
https://acint.net/rmatch/?r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F$%7BUSER_ID%7D&dp=151&tc=1
https://ssp-rtb.sape.ru/rmatch?r=https%3A%2F%2Facint.net%2Frmatch%3Fdp%3D14%26euid%3D$%7BUSER_ID%7D%26r%3Dhttps%253A%252F%252Fan.yandex.ru%252Fmapuid%252Fsapeis%252F$%257BUSER_ID%257D&dp=14
https://acint.net/rmatch?dp=14&euid=5303420A008ECF652000197802B5CA11&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fsapeis%2F$%7BUSER_ID%7D
https://an.yandex.ru/mapuid/sapeis/0500007F008ECF6539034B1102BD7B3C

43 B
81 B

61ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/sapeis/0500007F008ECF6539034B1102BD7B3C

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
server: openresty
p3p: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
location: https://an.yandex.ru/mapuid/sapeis/0500007F008ECF6539034B1102BD7B3C
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 154
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2

200

ed83a0cc-d086-522f-bbc0-8b27de0f0527
an.yandex.ru/mapuid/betweendigitalis/ Frame A7AE
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F%24%7BUSER_ID%7D&crf=1&rts=7528136466689875515
https://an.yandex.ru/mapuid/betweendigitalis/ed83a0cc-d086-522f-bbc0-8b27de0f0527

43 B
83 B

127ms
57ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/betweendigitalis/ed83a0cc-d086-522f-bbc0-8b27de0f0527

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/betweendigitalis/ed83a0cc-d086-522f-bbc0-8b27de0f0527
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/adobedmp/
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=41223CA6D0DFCA31
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=41223CA6D0DFCA31

42 B
717 B

39ms
37ms

Image
image/gif

54.170.147.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=41223CA6D0DFCA31

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

54.170.147.129 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v055-083604e23.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 4fjLOvjOSts=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v055-07bca2775.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: qvL2lZgMQnc=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=41223CA6D0DFCA31
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

match
ads.betweendigital.com/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/betweenx/
https://ads.betweendigital.com/match?bidder_id=161&external_user_id=6765617ED801C9AC
https://ads.betweendigital.com/match?bidder_id=161&external_user_id=6765617ED801C9AC&crf=1&rts=1632023304525681292

68 B
598 B

15ms
15ms

Image
image/png

188.42.191.196
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=161&external_user_id=6765617ED801C9AC&crf=1&rts=1632023304525681292
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 188.42.191.196 , Luxembourg, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

location: /match?bidder_id=161&external_user_id=6765617ED801C9AC&crf=1&rts=1632023304525681292
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H/1.1

204
No Content

pixel
im.bluevoox.com/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/blueseaxcom/
https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=C33E3902905B55C

0
241 B

329ms
97ms

Image
text/plain

52.45.175.185
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=C33E3902905B55C
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 52.45.175.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-175-185.compute-1.amazonaws.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Connection: close
Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: openresty

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120230768-8168572502050764927-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://im.bluevoox.com/pixel?s1=1&s2=1315&s3=vldyrx2shs82pv9o&cm=1&rd=1&puid=C33E3902905B55C
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandex_llc
https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
232 B

46ms
16ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120231153-11455680592825739813-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandex_llc&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandexcom
https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
409 B

44ms
15ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120231438-12725884854228829474-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandexcom&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/google/?partner-tag=yandexru
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

170 B
232 B

45ms
16ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120231692-3401420467917091551-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=1F6D909EE768055C&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H/1.1

200
OK

cm.gif
ad.mail.ru/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/mailweb/
https://ad.mail.ru/cm.gif?p=155&id=FAF6FB05DDF5A65B

43 B
452 B

178ms
58ms

Image
image/gif

2a00:1148:db00::17
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.mail.ru/cm.gif?p=155&id=FAF6FB05DDF5A65B
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 2a00:1148:db00::17 , Russian Federation, ASN47764 (VK-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Last-Modified: Fri, 16 Feb 2024 16:32:00 GMT
Server: nginx
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Content-Type: image/gif
Cache-Control: max-age=21600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43
Expires: Fri, 16 Feb 2024 22:32:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120232027-14888291848539591479-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://ad.mail.ru/cm.gif?p=155&id=FAF6FB05DDF5A65B
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/minimobww/
https://yandex.digital-services.solutions/api/sync?demand=YANV2EU&userid=9FB031F897E77080&expires=1&usergroup=1
https://x.bidswitch.net/sync?dsp_id=469&user_id=9FB031F897E77080&expires=1&user_group=1

43 B
235 B

144ms
18ms

Image
image/gif

35.214.149.91
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=469&user_id=9FB031F897E77080&expires=1&user_group=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 35.214.149.91 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS: 91.149.214.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://x.bidswitch.net/sync?dsp_id=469&user_id=9FB031F897E77080&expires=1&user_group=1
date: Fri, 16 Feb 2024 16:32:00 GMT
x-powered-by: Express
content-length: 109
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2

200

sync
t.adx.opera.com/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/operacom/
https://t.adx.opera.com/sync?vendor=60143&uid=668C5469687238E5

35 B
467 B

80ms
17ms

Image
image/gif

82.145.213.8
NO-OPERA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.adx.opera.com/sync?vendor=60143&uid=668C5469687238E5
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 82.145.213.8 , United States, ASN39832 (NO-OPERA, NO),
Reverse DNS: n-sysadmin-jumpbox-03.feednews.opera.technology
Software: Tengine /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: Tengine
access-control-allow-methods: POST, GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120245990-11806634326856806919-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://t.adx.opera.com/sync?vendor=60143&uid=668C5469687238E5
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2 200 /
yandex.ru/an/mapuid/videonowssp/ Frame A7AE 0
0 71ms
67ms Image
text/html 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://yandex.ru/an/mapuid/videonowssp/
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H/1.1

200
OK

user-sync
sync.adkernel.com/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/xapadsssp/
https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=61E8012D679EDC23

42 B
202 B

55ms
14ms

Image
image/gif

77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=61E8012D679EDC23
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Cache-Control: no-store
Server: nginx
Connection: close
Content-Length: 42
Content-Type: image/gif

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120246495-2255365712714115305-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://sync.adkernel.com/user-sync?dsp=94&t=image&uid=61E8012D679EDC23
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

sync
gw-iad-bid.ymmobi.com/dsp/user/ Frame A7AE
Redirect Chain

https://yandex.ru/an/mapuid/yeahmobissp/
https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=1424C61D0F80B237

0
38 B

681ms
95ms

Image
text/plain

47.253.61.56
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=1424C61D0F80B237
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 47.253.61.56 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-length: 0

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1708101120246816-16223528031663189599-balancer-l7leveler-kubr-yp-vla-115-BAL
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
location: https://gw-iad-bid.ymmobi.com/dsp/user/sync?dspid=eWFuZGV4X2RzcA==&dspuid=1424C61D0F80B237
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2

200

487a817ce29ec5f4329675268f2f39364fcb8dac08ef79275f155abbc51a74e3
an.yandex.ru/mapuid/mediascope/ Frame A7AE
Redirect Chain

https://cm.tns-counter.ru/yacm
https://an.yandex.ru/mapuid/mediascope/487a817ce29ec5f4329675268f2f39364fcb8dac08ef79275f155abbc51a74e3

43 B
83 B

56ms
52ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediascope/487a817ce29ec5f4329675268f2f39364fcb8dac08ef79275f155abbc51a74e3

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: ms-counter-4.4.3/1.22.1
content-type: text/html
location: https://an.yandex.ru/mapuid/mediascope/487a817ce29ec5f4329675268f2f39364fcb8dac08ef79275f155abbc51a74e3
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2

204

cr
cr.frontend.weborama.fr/ Frame A7AE
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F{WEBO_CID}
https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=1459222452

0
45 B

16ms
15ms

Image
text/plain

34.111.129.221
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=1459222452
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 34.111.129.221 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 221.129.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
via: 1.1 google
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:31:59 GMT
via: 1.1 google
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://cr.frontend.weborama.fr/cr?key=yandex&url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=1459222452
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 204 match
dm.hybrid.ai/ Frame A7AE 0
280 B 52ms
15ms Image
text/plain 37.230.131.16
HYBRID-POLAND

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/match?id=182

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.230.131.16 Amsterdam, Netherlands, ASN200197 (HYBRID-POLAND, PL),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: https://yastatic.net
cache-control: no-cache, no-store
access-control-allow-credentials: true
x-mode: 575
x-xss-protection: 1; mode=block
expires: -1

GET
H2 204 yandexdmp-match
dm.hybrid.ai/ Frame A7AE 0
238 B 52ms
15ms Image
text/plain 37.230.131.16
HYBRID-POLAND

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/yandexdmp-match

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.230.131.16 Amsterdam, Netherlands, ASN200197 (HYBRID-POLAND, PL),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: *
cache-control: no-cache, no-store
x-mode: 572
x-xss-protection: 1; mode=block
expires: -1

GET
H2

200

NMKLHl5HDNKwoLA7wPjv
an.yandex.ru/mapuid/dmpamberdata/ Frame A7AE
Redirect Chain

https://dmg.digitaltarget.ru/1/119/i/i?i=1708101119
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&ts=1708101120367&i=1708101119
https://an.yandex.ru/mapuid/dmpamberdata/NMKLHl5HDNKwoLA7wPjv

43 B
81 B

60ms
54ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpamberdata/NMKLHl5HDNKwoLA7wPjv

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
Server: nginx
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Location: https://an.yandex.ru/mapuid/dmpamberdata/NMKLHl5HDNKwoLA7wPjv
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H2

200

wkxIxSgfHYszjazVfBpvMgWTJEpsjDRL
an.yandex.ru/mapuid/mediasurferis/ Frame A7AE
Redirect Chain

https://dsp.mpartner.digital/dmp/syncsspdmp?sspid=4
https://an.yandex.ru/mapuid/mediasurferis/wkxIxSgfHYszjazVfBpvMgWTJEpsjDRL

43 B
83 B

62ms
58ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediasurferis/wkxIxSgfHYszjazVfBpvMgWTJEpsjDRL

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/mediasurferis/wkxIxSgfHYszjazVfBpvMgWTJEpsjDRL
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/html; charset=utf-8
content-length: 109
p3p: policyref="//dsp.mpartner.digital/w3c/p3p.xml", CP="NON DSP COR CURa ADMa DEVa OUR BUS UNI COM NAV INT STA"

GET
H2 200 server_match
euw-ice.360yield.com/ Frame A7AE 43 B
199 B 109ms
32ms Image
image/gif 52.48.224.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://euw-ice.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fazerionis%2F{PUB_USER_ID}
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.48.224.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-48-224-161.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 16 Feb 2024 16:32:00 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

78bc66ac-61a1-49e6-6302-3b91055ae1ec
an.yandex.ru/mapuid/buzzooladspis/ Frame A7AE
Redirect Chain

https://exchange.buzzoola.com/cookiesync/redirect/yandex?redirect_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbuzzooladspis%2F%24%7BUUID%7D
https://an.yandex.ru/mapuid/buzzooladspis/78bc66ac-61a1-49e6-6302-3b91055ae1ec

43 B
83 B

122ms
57ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/buzzooladspis/78bc66ac-61a1-49e6-6302-3b91055ae1ec

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/buzzooladspis/78bc66ac-61a1-49e6-6302-3b91055ae1ec
date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx
content-length: 113
serverid: TODO
content-type: text/html; charset=utf-8

GET
H2

200

1759798406215141831
an.yandex.ru/mapuid/targetads/ Frame A7AE
Redirect Chain

https://eye.targetads.io/sync/yandex/
https://an.yandex.ru/mapuid/targetads/1759798406215141831

43 B
81 B

59ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/targetads/1759798406215141831

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/targetads/1759798406215141831
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0

GET

mts
pixel.konnektu.ru/redirect/ Frame A7AE
Redirect Chain

https://kimberlite.io/rtb/sync/yandex
https://solta-sync.rutarget.ru/sync
https://kimberlite.io/rtb/sync/segmento?u=xLX4P1namn4n
https://sm.rtb.mts.ru/p?ssp=toptraffic&id=Zc-OALxVDDw
https://vma.mts.ru/match/second?ssp=59&exu=Zc-OALxVDDw
https://tech.rtb.mts.ru/?dsp_uid=ec8fd712-52e5-4127-8fc9-2893d6d6d063&return_url=https%3A%2F%2Fpixel.konnektu.ru%2Fredirect%2Fmts%3Fcallback_url%3Dhttps%253A%252F%252Fvma.mts.ru%252Fem%253Fnext%253...
https://pixel.konnektu.ru/redirect/mts?callback_url=https%3A%2F%2Fvma.mts.ru%2Fem%3Fnext%3D59%26em%3D1%26ssp%3Dkonnektu%26id%3D%7BUSER_ID%7D

0
0

GET
H2

200

/
an.yandex.ru/mapuid/targetrtbis/ Frame A7AE
Redirect Chain

https://match.new-programmatic.com/userbind?src=yandex&pbf=1&gi=1
https://an.yandex.ru/mapuid/targetrtbis/

43 B
81 B

55ms
50ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/targetrtbis/

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: nginx/1.22.1
Vary: Origin
Access-Control-Allow-Origin: *
Location: https://an.yandex.ru/mapuid/targetrtbis/
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET pixel
mitdmp.whiteboxdigital.ru/ Frame A7AE 0
0

GET
H/1.1

204
No Content

cm
nr.bidderstack.com/yandex/ Frame A7AE
Redirect Chain

https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}
https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}&pupa=1

0
194 B

14ms
14ms

Image
text/plain

142.132.211.137
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nr.bidderstack.com/yandex/cm?user_id={partner_user_id}&pupa=1
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Server: 142.132.211.137 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.137.211.132.142.clients.your-server.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 16 Feb 2024 16:32:00 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 0

Redirect headers

Location: /yandex/cm?user_id={partner_user_id}&pupa=1
Access-Control-Allow-Origin: *
Date: Fri, 16 Feb 2024 16:32:00 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

000022d4-65cf-8dff-616a-75344e777201
an.yandex.ru/mapuid/ramblerssp/ Frame A7AE
Redirect Chain

https://profile.ssp.rambler.ru/sync3.302?pid=188
https://an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-8dff-616a-75344e777201

43 B
81 B

56ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-8dff-616a-75344e777201

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=0
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
location: //an.yandex.ru/mapuid/ramblerssp/000022d4-65cf-8dff-616a-75344e777201
content-type: application/x-javascript
x-passed: 2bal1
content-length: 0

GET
H2

200

6JchSamxFWU.AikABlGNssKyyw
an.yandex.ru/mapuid/getintentis/ Frame A7AE
Redirect Chain

https://px.adhigh.net/p/cm/yandexssp
https://px.adhigh.net/p/cm/yandexssp?bounced=1
https://an.yandex.ru/mapuid/getintentis/6JchSamxFWU.AikABlGNssKyyw

43 B
81 B

54ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/getintentis/6JchSamxFWU.AikABlGNssKyyw

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx
x-backend-id: f13-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: *
location: https://an.yandex.ru/mapuid/getintentis/6JchSamxFWU.AikABlGNssKyyw
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 y
rtb-eu-warsaw.intent.ai/um/ Frame A7AE 68 B
916 B 80ms
37ms Image
image/png 2606:4700:20::ac43:48bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb-eu-warsaw.intent.ai/um/y

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48bf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
x-envoy-decorator-operation: bidding-gateway.infra-prod.svc.cluster.local:8080/*
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-envoy-upstream-service-time: 0
content-length: 68
pragma: no-cache
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FGu4OVq4nawyV6DLMuO3%2Fn1gaS0DC3%2FYXwCBQ4hV%2F2HcJuWy89ci8mnzcf4I29EPoIaja%2BcKaWvMJ72ZC40GcbLNsCmhqlPla5OWqAnsziT5WRkOiFxWt2p1g7iaygjTzmFImEFeuzTGX82QM6I%2FBNryUdVj"}],"group":"cf-nel","max_age":604800}
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
cf-ray: 85672f234fd83738-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
expires: Wed, 11 Nov 1998 11:11:11 GMT

GET
H2

200

x1lO0j0zWabHRMXdg2TH
an.yandex.ru/mapuid/kadamis/ Frame A7AE
Redirect Chain

https://s.uuidksinc.net/match/501
https://an.yandex.ru/mapuid/kadamis/x1lO0j0zWabHRMXdg2TH

43 B
81 B

65ms
62ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/kadamis/x1lO0j0zWabHRMXdg2TH

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/kadamis/x1lO0j0zWabHRMXdg2TH
date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx/1.23.2
content-length: 0

GET
H2

200

pixel
shopnetic.com/api/rtb/dmp/ Frame A7AE
Redirect Chain

https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex
https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1

43 B
406 B

48ms
48ms

Image
image/gif

77.244.216.90
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

77.244.216.90 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
server: nginx
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS"
content-type: image/gif
cache-control: no-cache, private, max-age=0
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 03:00:00 MSK

Redirect headers

location: https://shopnetic.com/api/rtb/dmp/pixel?partner=yandex&tc=1
date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H2

200

ec8fd712-52e5-4127-8fc9-2893d6d6d063
an.yandex.ru/mapuid/mtsdspis/ Frame A7AE
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=yandex&id=map
https://vma.mts.ru/match/second?ssp=55
https://tech.rtb.mts.ru/?dsp_uid=ec8fd712-52e5-4127-8fc9-2893d6d6d063&return_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fmtsdspis%2Fec8fd712-52e5-4127-8fc9-2893d6d6d063
https://an.yandex.ru/mapuid/mtsdspis/ec8fd712-52e5-4127-8fc9-2893d6d6d063

43 B
153 B

53ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mtsdspis/ec8fd712-52e5-4127-8fc9-2893d6d6d063

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:01 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:01 GMT

Redirect headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: nginx/1.20.2
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://an.yandex.ru/mapuid/mtsdspis/ec8fd712-52e5-4127-8fc9-2893d6d6d063
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2

200

ct_sync.php
sync.magnitent.com/fbfli/ Frame A7AE
Redirect Chain

https://sonar.semantiqo.com/dmp/scr.php
https://counter.yadro.ru/id127/reff-id.gif?sid=d3203564f47f40a69317b0c356706fe8
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=2A34F5D17280F64B&sid=d3203564f47f40a69317b0c356706fe8
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=d3203564f47f40a69317b0c356706fe8&spid=2A34F5D17280F64B&v=
https://sync.magnitent.com/fbfli/ct_sync.php?ct=79b92535c3a44e6c8e7d9b2253484e17&sonar=d3203564f47f40a69317b0c356706fe8&spid=2A34F5D17280F64B&v=

0
675 B

134ms
46ms

Image
text/html

95.217.109.66
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.magnitent.com/fbfli/ct_sync.php?ct=79b92535c3a44e6c8e7d9b2253484e17&sonar=d3203564f47f40a69317b0c356706fe8&spid=2A34F5D17280F64B&v=
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 95.217.109.66 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.66.109.217.95.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *, *
date: Fri, 16 Feb 2024 16:32:01 GMT
mode: no-cors, no-cors
cache-control: no-cache, no-cache
content-encoding: gzip
server: nginx/1.20.1
content-type: text/html; charset=UTF-8

Redirect headers

location: https://sync.magnitent.com/fbfli/ct_sync.php?ct=79b92535c3a44e6c8e7d9b2253484e17&sonar=d3203564f47f40a69317b0c356706fe8&spid=2A34F5D17280F64B&v=
access-control-allow-origin: *
date: Fri, 16 Feb 2024 16:32:00 GMT
mode: no-cors
server: nginx/1.20.1
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame A7AE 42 B
201 B 331ms
76ms Image
image/gif 81.222.128.215
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=109
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.215 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad15.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame A7AE 42 B
201 B 309ms
77ms Image
image/gif 81.222.128.215
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=19
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.215 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad15.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H/1.1 200
OK /
sync.bumlam.com/ Frame A7AE 43 B
390 B 34ms
8ms Image
image/gif 31.172.81.158
DE-FIRSTCOLO www....

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bumlam.com/?src=yandex
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 31.172.81.158 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif
Date: Fri, 16 Feb 2024 16:32:00 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Server: nginx
Connection: keep-alive
Content-Length: 43
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2

200

e8e73f72-cce8-11ee-9e62-002590c82436
an.yandex.ru/mapuid/adsniperis/ Frame A7AE
Redirect Chain

https://sync.bumlam.com/?src=yandex2
https://sync.bumlam.com/?src=yandex2&s_data=CAIQARiAnL6uBqIBEOjnP3LM6BHunmIAJZDIJDY*
https://an.yandex.ru/mapuid/adsniperis/e8e73f72-cce8-11ee-9e62-002590c82436

43 B
81 B

53ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/adsniperis/e8e73f72-cce8-11ee-9e62-002590c82436

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://an.yandex.ru/mapuid/adsniperis/e8e73f72-cce8-11ee-9e62-002590c82436
Access-Control-Allow-Origin: https://yastatic.net
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2 204 yandexortb
sync.dmp.otm-r.com/match/ Frame A7AE 0
69 B 111ms
42ms Image
text/plain 159.69.72.5
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.dmp.otm-r.com/match/yandexortb
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.69.72.5 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.5.72.69.159.clients.your-server.de
Software: nginx/1.17.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx/1.17.0

GET
H2

200

NTdmYWZiZWJkMjk3MTI0Mw
an.yandex.ru/mapuid/gonetisnew/ Frame A7AE
Redirect Chain

https://sync.gonet-ads.com/match/yandex?id=[buyerUid]
https://sync.gonet-ads.com/match/yandex?id=%5BbuyerUid%5D&chk=1
https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw

43 B
81 B

53ms
53ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://an.yandex.ru/mapuid/gonetisnew/NTdmYWZiZWJkMjk3MTI0Mw
content-length: 0
x-xss-protection: 1; mode=block

GET
H2

200

d16eeae4-c92e-4ae7-9bc8-febd38b40517
an.yandex.ru/mapuid/upravelis/ Frame A7AE
Redirect Chain

https://sync.upravel.com/yandex/sync
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://an.yandex.ru/mapuid/upravelis/d16eeae4-c92e-4ae7-9bc8-febd38b40517

43 B
81 B

56ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/upravelis/d16eeae4-c92e-4ae7-9bc8-febd38b40517

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

date: Fri, 16 Feb 2024 16:32:00 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://an.yandex.ru/mapuid/upravelis/d16eeae4-c92e-4ae7-9bc8-febd38b40517
access-control-allow-origin: *
content-type: image/png
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: false
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0

GET
H2

200

J8Op11tHwelW6e6EeZcxtA
an.yandex.ru/mapuid/dmpaidatame/ Frame A7AE
Redirect Chain

https://x01.aidata.io/0.gif?pid=YANDEX
https://x01.aidata.io/0.gif?pid=YANDEX&bounce=1
https://an.yandex.ru/mapuid/dmpaidatame/J8Op11tHwelW6e6EeZcxtA?sign=519980585

43 B
81 B

54ms
54ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpaidatame/J8Op11tHwelW6e6EeZcxtA?sign=519980585

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:01 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:01 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
last-modified: Fri, 16 Feb 2024 16:31:59 GMT
server: nginx
access-control-allow-methods: GET, POST
p3p: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA'
location: https://an.yandex.ru/mapuid/dmpaidatame/J8Op11tHwelW6e6EeZcxtA?sign=519980585
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Fri, 16 Feb 2024 16:31:59 GMT

GET
H2

200

xLX4P1namn4n
an.yandex.ru/mapuid/dmpsegmento/ Frame A7AE
Redirect Chain

https://yandex-dmp-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/dmpsegmento/xLX4P1namn4n?sign=1029756920

43 B
81 B

55ms
55ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpsegmento/xLX4P1namn4n?sign=1029756920

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:01 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:01 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/dmpsegmento/xLX4P1namn4n?sign=1029756920
Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: nginx
Connection: close
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

xLX4P1namn4n
an.yandex.ru/mapuid/rutargetis/ Frame A7AE
Redirect Chain

https://yandex-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/rutargetis/xLX4P1namn4n

43 B
81 B

54ms
52ms

Image
image/gif

2a02:6b8::90
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/rutargetis/xLX4P1namn4n

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

2a02:6b8::90 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 16:32:01 GMT
content-security-policy-report-only: default-src 'none'; base-uri 'none'; script-src 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech http://an.yandex.ru; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs-partner-ro&project=yabs&yandex_login=&platform=
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Fri, 16 Feb 2024 16:32:01 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/rutargetis/xLX4P1namn4n
Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: nginx
Connection: close
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET d.png
ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/ Frame A7AE 0
0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 1621
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

23ms
23ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 222C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 241172641c50676e543fed1ab4cdd9e54b2bcc421893ad7b8e499fbe14d00051

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 222C
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CbEFL_43PZci3Lb6E5t0P8fKMwAys5q_wdb_HxbGuErCQHxABIM2U5GxgleKQgqAHoAGcr_uoAsgBAqgDAcgDyQSqBPIBT9CO2b_G68GysxKXi9lrsQY-6CLHl2AjWt-m6jQV2Uvf5hCkeDn...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212552309648700444308%22,%22debug_reporting%22:true,%22destination%22:%22https://hero-wars.com%22,%22event_report_window%22...

0
0

52ms
38ms

Fetch
text/css

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212552309648700444308%22,%22debug_reporting%22:true,%22destination%22:%22https://hero-wars.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22622778268%22],%2222%22:[%22true%22],%224%22:[%2202-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%226585879440170967137%22}&andc=true

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"12552309648700444308","debug_reporting":true,"destination":"https://hero-wars.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["622778268"],"22":["true"],"4":["02-16"],"6":["true"]},"priority":"500","source_event_id":"6585879440170967137"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:00 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"12552309648700444308","debug_reporting":true,"destination":"https://hero-wars.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["622778268"],"22":["true"],"4":["02-16"],"6":["true"]},"priority":"500","source_event_id":"6585879440170967137"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame 89D9 51 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:39:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 244346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:39:34 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402120101/ 165 KB
56 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402120101/reactive_library_fy2021.js?bust=31081168

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03fd06fe9ab8a0ed9d5a705164304105a26e60c55af23670cdf55071ac73119f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57036
x-xss-protection: 0
server: cafe
etag: 1368996125763517586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1418 42 B
63 B 37ms
37ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Coh8NZhLmTWZZuz7hUPeD3Yp7ThlldkkSFDHL8JAhO1fZ-Dtj8xTNISINjmMd05nWtmWYLTjRSZhMe7fbN0Fw_uvQwSm2Zaspd-eQ8O5xdgsCHEvE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1418 93 KB
33 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 1418 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 1418 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 1418 204 KB
61 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 79ms
46ms Preflight
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6EE 624 B
242 B 47ms
47ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUHbeqdYWgwMRa7jpCqSU4yzLwAcjlThQMuMVopBv6KOJrWb0rAgOpBvMUHEkFuMOAwSpxO_lH9Y_1AuWvmBkBilnh18UiXrljRQpX-alxSw7vsz1I8TZJENDUSXa7kAyvd51r1gF3x0A_WUZoS9xWWNRDeJp5ZGGVG8nL_gNsthyYR6F4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9C3E 42 B
63 B 38ms
38ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BecvCKzgsfKLezlFGPKznE1BByDyMjWuF4Zg_HW5ovb1dV9jLj2vnJ-oQRsAJu3Ut8YQ4UvCtzs7wy0u9AoHCyxFOYf-6zPw7KoiuHJpo5KkV6qxc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119672&bpp=1&bdt=832&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9C3E 93 KB
33 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 9C3E 3 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 9C3E 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9C3E 204 KB
61 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6309 640 B
265 B 45ms
45ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVYbmbewGXCd84bsCCIR-FUH6cNxivcsblauLzXeIHvcuCTKBMZOFAw2PtSk8enzaJoDvDy0OpQbZCKSiPvImt1N48CCdZhDnF4KoETRAVppSG78qxmNBFWJ-8yWDcNUrv-8ZHqoNRsn2eUfE-3ylyhsjxKmM515U6EmzRAnqnHlSBg_mg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119672&bpp=1&bdt=832&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame C6EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&C=1

43 B
340 B

30ms
26ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUHbeqdYWgwMRa7jpCqSU4yzLwAcjlThQMuMVopBv6KOJrWb0rAgOpBvMUHEkFuMOAwSpxO_lH9Y_1AuWvmBkBilnh18UiXrljRQpX-alxSw7vsz1I8TZJENDUSXa7kAyvd51r1gF3x0A_WUZoS9xWWNRDeJp5ZGGVG8nL_gNsthyYR6F4
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1nN6DO6zXvzP41U81zFrII%2FZ1JVy8nq71c8GuGHlR4IDdObeq4su5mRZUrfUUHbKDDnquxvKTbuEcxiQuTnMhnnucyplfLuymjERc%2BUj%2Fjvp5AIJQk2b5CUe82%2FFdG64APY5JefCP%2BA2YQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85672f22eb1abb97-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4nLO6dLQFnzWI6e2lJQyfltEN%2FUGl3tPFHnasn4bXoag5fFxYLrKnpJidnreVv3NexYxukD8zyPiWgpwywSIl9h8Sw7QtQKp5bFKGIvJZyn1dCE9NwxqGEV%2BQt19BpI4PO2v7888EHaLbw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&C=1
cache-control: no-cache
cf-ray: 85672f228a62bb97-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C6EE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Zc.OALmqPd4AAER-ANA8bgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&google_hm=2

43 B
772 B

50ms
47ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUHbeqdYWgwMRa7jpCqSU4yzLwAcjlThQMuMVopBv6KOJrWb0rAgOpBvMUHEkFuMOAwSpxO_lH9Y_1AuWvmBkBilnh18UiXrljRQpX-alxSw7vsz1I8TZJENDUSXa7kAyvd51r1gF3x0A_WUZoS9xWWNRDeJp5ZGGVG8nL_gNsthyYR6F4
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fr60IYePGllqNHF4jfJNj9X%2Fu1zZCqrqB%2B0FYlViQ7eevX0h203oZAP%2BsOwcztY%2BfZ3JUkivrStCuLDCZCfJ9vaX438g2xleErwM%2B5DkDI3B6uUyCwH6O9bIz7PBTRNnkewIJBI77RA4ZA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85672f236ca48fec-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3q0igoov-tweCWzLGMj8s&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame C6EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFFQxKKc0grqPmPN1zxGS0I&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFFQxKKc0grqPmPN1zxGS0I%26google_cver%3D1

43 B
1 KB

10ms
9ms

Image
image/gif

37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFFQxKKc0grqPmPN1zxGS0I%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUHbeqdYWgwMRa7jpCqSU4yzLwAcjlThQMuMVopBv6KOJrWb0rAgOpBvMUHEkFuMOAwSpxO_lH9Y_1AuWvmBkBilnh18UiXrljRQpX-alxSw7vsz1I8TZJENDUSXa7kAyvd51r1gF3x0A_WUZoS9xWWNRDeJp5ZGGVG8nL_gNsthyYR6F4

Protocol

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
an-x-request-uuid: b3c14c74-89fa-44e8-8688-4e228fb94f96
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
an-x-request-uuid: de3924e5-144a-4065-a96b-47809ebff155
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFFQxKKc0grqPmPN1zxGS0I%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.75; 45.141.152.75; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C6EE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTI2MjYyOTYzNDY4MjIx

170 B
188 B

25ms
25ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTI2MjYyOTYzNDY4MjIx

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
an-x-request-uuid: 8c70af28-e211-46b8-bb7f-09addfe6d764
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTI2MjYyOTYzNDY4MjIx
x-proxy-origin: 45.141.152.75; 45.141.152.75; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame D316 9 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 07:48:06 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 07:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame 23EB 9 KB
4 KB 13ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 07:48:06 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 07:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame 581A 9 KB
4 KB 13ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 07:48:06 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 07:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/ Frame C126 9 KB
4 KB 13ms
13ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba2c2b2479cc7044e4af1a0123ec24531e8ad57aa91d4d5655405a148271589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 31434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4209
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 07:48:06 GMT
etag: 3890843268177463596
expires: Fri, 01 Mar 2024 07:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1418 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4761453926852&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1418 0
20 B 39ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4761453926852&version=m202401290101&ct=77&x=1&cor=3736979346438161000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1418 35 KB
20 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CNeOw6j3E_3Ktq_vH-o6axvbiUcZQ3tEEDKudidWav3jBMdU4at1HrLzaNa3Tbgd-oh4lz7DECB1eIFM38o2dSIV01PRBxNJC5GVNMnrMbhfLNXSGvCZFKsDFM0b_iaY1egr7eayTGxN8BNCg79Laa1jdUGUjlGrd_I_7yiPsJLKFsg_8&cry=1&dbm_d=AKAmf-AA8B11n8xSskNl2rQ4YsUi0Gx4FJtj84N8E8EvR_g9gOsaz2-fk53DdFwBsKTPutQxgSxnu_Ma6wf2__7CPKE9912yRakOZfh6C8hz43YOi7tvSHtlXRZQVyqhm_GgNsFwNzRYtIyB_ScLlIoR0CmGkd2jImG6M1wAw2rO4AAUezDaUKZc713hqXMhBpdJrjC53ludyxUEohQ4HCdSohmpawHG9BnCVAJkxdlaQ1_bEsxuk0SNk_ZVHbrIjLqi_A90cFFP2hUDlF5dnOXddc9pxqrJlqlt2_Fy3LHBN0wMC3k-GCGmRc-6xHsqTzE4NnUCKfXYhoi3kw-g4QGM2Yk81VSWHW20s9t6jwCZcc_TqODpW8as_2tTATPckl7gDLNvK_tywTpB2t3LRgfWRraSILFFCqDVd-t36IBF_-vKxdkJ8M9BFt-RrPitQS-SryVDsdhGdF3INUx8N1Im6qJaqzGU0MGoMZ2VPWY0QL17lD3QpABsQ-ORtDR4JQt73mYwCNlxNjfBahUCUGL8YWQqBOjurX2--zRPDr2HQ8fcsIhM-yelAgcqQ1pccJdzXEJixjivX1QmUmtOb90rtJ-REz_4_nXpuXuDLCy08L9bsoasndABl4HmjXZg2lGj6uj5XwjS7UlRnNos6lTCLPvrWVuCXfnth3LcR9daCkiD1VrbWsJT2J4OP127O-6k8dbmC1rWOIjiHHEb_UxAbpyAZ1XEhdmx98Ybz5obQ7-ceR8hi7jqqK8y2K0bHfPASWOQqX_WQLigbdMbsHPT5V5QX59qsjhSH4aMKVNfIW9ewghK0wfLDLP96NIF3Vnme2D9MpToEBuh3HA5iHqzMuWGe1IH4IfdFVkjyhqhzzlJBTvBmWlNJ7zTNy2BLGFf6CsC32G97PX1uYijRiT-ZhnYA5guPT5zvpM0CdVq12g3QAzzHIpnBW3GHaevbZnZwOLkgWZfa5S2gjIboV8BFycXKcxWyRuaXnNNLZqW97fLj1IuiCFx3SD9YlwaMjlPb9WoHg6UNc5fM2gwGgmoJzkFe1xv0H0KCISVpPfedyq8YEbM1IJCMnbcZj_TZ7q7MvwpclYYDW30iham4rXTId-UYwj4zBbZD_fqTlhSXVHBfIDPlbUO6QoQt8eNscGNLIrbwGhYBu_UEIhNaSNkApaLv6S1bU04T5q4oZRZeAEOkKwgZdo7GEx9wcQnqc3MZ6giaDNthY4UiZHCyMwvQbtmIm8RtL_aPC9JADFgUiEr69ov3tXIy8JHBLZDOzjtW9DmtRiVG1ZRmlYy99ZlZkkXfyrWrRwcP-zWMsbl-pMz955qf6OPuPEFFWctQKxJabFxE05rVFNT02L56PIkAjyaiEmWkOKJrnr1Vrog_npMZluZFPPg64IRLIXz_SqWWT-Ko5XppoQM3vDckO6rqAMoKekHocu89X0ner6D8AnKp0o3zHJjWIAVvaH7nfGmsp8FH0uM7Gr538WICPEceuECN6jSYa_gO-x7TOcC01DG0Klfp09OfueuX7KvGr_XKB_HUC0K2DVjGk7iaBFTsgNDE-Kdi3pMoKXcPC0W8aN9tyVkxDKESErbH2g_tOtDZN4Tk5xG6TRbeoLYrdJyY_ezC8O099kTijzOTqtUnyVNLNYaJiouySIVSEgCT8gvUAOmGnqdyt8_HC2HvCBAlLi88FJtecftyStU-yTIf09VdJ09ZXVJz38imcttvGpskOz2hupZJEHaNwIcQkR8-lwGbHtBtOyNNkJ8zbZMXxpNhYIjLG4d-Sxc56RhKAkiYFTU4sb4YM8AP8MnQwmXUdhgOR4Yn_og4FKLu2OK5IhXeyk-tNI56YCSw010KsJIX2Vhf3stY2MTe27m6liOqT3tPQgNzASH3ZIl3U8tP5O44-Z3zaYesrYBr3MG7VG9eTQ-FIJCFJv7sJ57T2a-4KTH33fLHWBn9N7GL0JpPnje291qmtXrFVF7e_PGPS9RGtI6AaTb9xOizf4KQsBtztdQfNXdU77OAbYUHD7eeAMlB9DrxkS1V5fjZqVFfcFq_FZ-AXrZpWxIB2DpQuMvI3idc5II2q43i2X96wjgMZv25ZVUvv66-0cO0yNlos6DQZdfil3ZKho81YNe0G0K-3TnzBK9cskFSxDWa4gTu4BQ4fcnyzgS4xwaaEIyK-Nrx2AIEXN4OmcwNucFQDFFW9m1fOU5N8s7PqoyJPTPlUE5bEH5LTRluOp5iYiS84oN5_dJ3IS_iHA15apkRY1YRTfJih8KpmxCzCtYCpZPd1y1EiiwdkxA-3JIyprJIWPacAH_WqSPjUzMCAukFV022GhQJjSvWaOa7Cw9FYHWBspbzlAPf6g8BVZGtrv-Z6muLzWqEUV5BPQvoxUXEtpo5j8sfmKQyeWXxigY452dT74ShOFb1AUSVmR15AWivaUxa26j6wAki5dKrfXV6duYCOQ3B12BI-gupNJcKiyEkJ59Qz4AZRbSIjgydvrLzGn4cflL3l4U8FvKoCwreLr9LZIPJxkHqCTYDBGpWxhOYacUCGtOAgu6Q0y_rPR7qYZeWLUqsAKToXGMa16DvgyaQlNx2-WxHF-CpH8xHfBglEJmSzjyA2M1x-o2CX_ZhdU79qmiK3S_ImkbIfblPJS4E3tGyDmohGUgInZD6wFw73Cmne5FT_bTxcgSwuVdjnPmhWLbsdDxR3hMMrM7cECanGX3v7sVbZAknxG-Whamw-_C6DE_0ktcTBWxV2JWkh8TFRJC4cVafyt3kd676krYjDFxNpW2K5yymVeO9NNrvTDP33JkQ_GRrGC2xRkPxfJESsvSxVIycsJg29J4YznuWVbP_4faJVhxvj5v2D1rNGSJ95fmDAbOg5PQXm1IaWnTknn79ObpY2HrYga5LlpmoWqO1Rby5ZH0RhZVoTjbQnJR5B8EKBOhYV0zAe5h8olG9T8nlGcgezCaBFfZHN0UYF0olMe4eCsnCByTG-jPYL_bKnygeVGVdEMaY9W6yi9U6NRa6WUlkL2hq7um0JNQdSt6V1siV0r7vrRgGXLJ2XzOa4aCVHrA6t-MsFlenBGxvnPkACpYGrjQGdkyib20aEP5G-gN-8xSNYAqKSQClFDg0nsjHdjXCwqyHKDlgwDjdyvMqu95iYT0X1_7UeUpUMzbuqcx7fp8emr0jGCr3WD8NuJQLhfdAIqGRszEjKbVImgyBwfTIKnIlqBRnaEEhlXtHEWytBcHIuqoCdfg8OnX_9nOsknhHhZeAwtTBEYacJdsEyo9adbbJW8zEqK6gIDMol0abtZmcwdm_PiIoDHsTL8Uh5Sut-NXZ1KnOoBuOJBu8Kkmq38RUiHYIvet1pe9_1s51Qa_OWNTRmiKjAKGVYBpZCNDb-AxPMPQJcL5_YToxTjlJ1QxswR8N295d-iKhp66yer4jSYPfav60Q_WPVZVw8FSwwVefdfEUdnXzQvPDPaJPnzSNK8lx6hgH-aXbBmke_WQPkYx3TXib64HnhPTtvMtN2YUKZ_ebSpkxPX90q-H4JvF8PzuY3jAwNHbkT6QTuj5oEtf3YL9V3I0b_IO3yKOCsUNbbr22RHtVEutq1AWW0QMoDnluXOyq0ScRnOBF2AP0tz9EjaPM9bcdqu6UhA_gr6-tghZF33HL0SkExYgZcMGpGK0n69f95BjiPmCl8RWnkkQWiJY-CgukjYZSWycSrxxJEeYwb3gMOmVh8LpAM2i7Fzj2JIAtDTC2fn6O92iZJ1ZJHew33tIrbhRsxNzCdkDLbJZGc978aJ8VfUI1dPzTjbyRzqDz9YVV_keb_5op65hos-pHyTVEivgxm_U1h86a6Gplpixgj9eSAtdbJrfDrhpbUiSvNNUVHUoTJdUKsyke7u86xcWlgf8EFcSxcSAsK43HYnAQyO6FtCarAFnjBrp51fETtio09Z-iEUNNTA2U_67-tUqDNdyPRY0GuRAzSuKLgJK2qKDGmy9b9gI6PQDbIJqO3hCPR0reG6L5CCVI4CMKriI_JRY8bm8ttCCLkqUI9BmbTyOCEk6dYLtcwnhRzWRYKv7APTLgXVT1mlIA1FBZR5zPMdk2VLYSjI7vIXXvYWOKeBLHOXTnilDNtAKbc54sb7Y9h6pxDd689Jhn9Xp_SEKvzveUtpcO5kOLxje5cwKpi1mvWkY0sRNe-XD_bKNA_4-6nZ8-FkMhnFnpO-OCIgq5ZmVjLo&cid=CAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=3736979346438161000&adk=2857193499&idt=53&cac=0&dtd=12

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6fd30b011c7c9ed001bd96746bfd3db3cd3f5f698eb11dd16a6d8f16f9ab92e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20182
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 443C 42 B
63 B 38ms
37ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DD40Pr9xjSxuWS0I7WoY-uOzzYz9vPbVA9tRKT7x8M4Yv7V3wrCO55c8yMuwAz5O-7yh7NZ9bL-MzRRrtDSGrk2ar15cpp4bagBsd4TNpMMgHN6Z8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 443C 93 KB
33 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 443C 3 KB
1 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 443C 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 443C 204 KB
61 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44B9 42 B
63 B 40ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bqe6OgvInXI_Cv9UuPtBV-UNJojUrmhdTTdbBIu56HyYP-k1GL1vLiy0SGkKceGItbBVrGP0XsCp5vudyFkLOvI7nwIzyvkViIBawkLJkvhwQpVV4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119789&bpp=1&bdt=949&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 44B9 93 KB
33 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 44B9 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 44B9 20 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 44B9 204 KB
61 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57D8 42 B
63 B 39ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cu2hz5YrUsTMQ_HZpBnixMn1DALkwQ6c6XItOO_rMmZgg_asHPyR1h-WE14cL6sbijA2e8lgpcs8ltWm0bUt-uYuSUVDfTe5ZojiK0jRNKLYFl2Mc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119581&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 57D8 93 KB
33 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 57D8 3 KB
1 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 57D8 20 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 57D8 204 KB
61 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6309
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1

43 B
105 B

32ms
18ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVYbmbewGXCd84bsCCIR-FUH6cNxivcsblauLzXeIHvcuCTKBMZOFAw2PtSk8enzaJoDvDy0OpQbZCKSiPvImt1N48CCdZhDnF4KoETRAVppSG78qxmNBFWJ-8yWDcNUrv-8ZHqoNRsn2eUfE-3ylyhsjxKmM515U6EmzRAnqnHlSBg_mg
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 6309 43 B
295 B 62ms
17ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVYbmbewGXCd84bsCCIR-FUH6cNxivcsblauLzXeIHvcuCTKBMZOFAw2PtSk8enzaJoDvDy0OpQbZCKSiPvImt1N48CCdZhDnF4KoETRAVppSG78qxmNBFWJ-8yWDcNUrv-8ZHqoNRsn2eUfE-3ylyhsjxKmM515U6EmzRAnqnHlSBg_mg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 6309
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1

23 B
163 B

71ms
33ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVYbmbewGXCd84bsCCIR-FUH6cNxivcsblauLzXeIHvcuCTKBMZOFAw2PtSk8enzaJoDvDy0OpQbZCKSiPvImt1N48CCdZhDnF4KoETRAVppSG78qxmNBFWJ-8yWDcNUrv-8ZHqoNRsn2eUfE-3ylyhsjxKmM515U6EmzRAnqnHlSBg_mg
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 6309 23 B
163 B 96ms
39ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVYbmbewGXCd84bsCCIR-FUH6cNxivcsblauLzXeIHvcuCTKBMZOFAw2PtSk8enzaJoDvDy0OpQbZCKSiPvImt1N48CCdZhDnF4KoETRAVppSG78qxmNBFWJ-8yWDcNUrv-8ZHqoNRsn2eUfE-3ylyhsjxKmM515U6EmzRAnqnHlSBg_mg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2961 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AxS3_lKt0CupqV3-IWlgA4uQ95uVLwMh_rzfWN0wYpX54qc4kHObgvKjyRwE23WNXYKBfpKBBVP5kM2CCTL7Gt-5TvgyD0PgwKnAVil-QtCsBtusU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2961 93 KB
33 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 2961 3 KB
1 KB 17ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 2961 20 KB
8 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2961 204 KB
61 KB 15ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9920 640 B
265 B 51ms
48ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVevxAtYNfKsEJL4PuIn5GRGGnWMX-TUx58GunGRb8TNdPii19LNiJiFJ7ZscSsSmEmWJ0iIqRIDfKeofr2La6JgiSihky83jC899ava7vEr28l8iK8pMk9yGI8yhIrtg8XM6K2hAmHZCXLHHFRt15tH3ai9M0fqBiKw87pFfKi6FzlMWM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E83C 640 B
265 B 51ms
48ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX7wdrNDobQe98lmcjFOeVY9mvxmcY5ATChaKdZzOUUxiPueST_iXNHQlavz3LuI0jkDQB09KQPTjT2XYgOkfA1OEiVkKHrphjUlsFfU6isqSPm7mIRIWeZrTNFBOI-yq1mtcLSOFtNvOJjsRDSyvy7xZDRodWedWbiyV52Ef7svRSUeEs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119789&bpp=1&bdt=949&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A2F9 466 B
238 B 49ms
47ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNUvIhUWelC-BOfV7uRKmnN74sd5mShGsx-zbKaei93dpO1K9B_YTXSE7stu0B2qiClYxMO2GJ_9z9Pw8OVB1K-aNu8NYjK42lXChWtKVuOw4jIFxCrqpA6dUt_Z0gAwdzbhICwN2Q2vQSkpoO05fVe81CZH8fVa9s52t1wsG9TmHTFezQQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119581&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame D316 5 KB
1 KB 49ms
17ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 14:59:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D316 205 B
296 B 44ms
8ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:53:15 GMT
x-content-type-options: nosniff
age: 232725
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 12 Feb 2025 23:53:15 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame D316 604 B
1 KB 43ms
7ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 04:03:39 GMT
x-content-type-options: nosniff
age: 217701
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 13 Feb 2025 04:03:39 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame D316 15 KB
6 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e33434b042c688fa1972d51e9c103fe592fca7a4dd50358c08449c7b0f5cb4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 19:36:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6487
x-xss-protection: 0
server: cafe
etag: 9214289930287671984
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 19:36:04 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame D316 22 KB
9 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

716b2a35acfc8e6a247c9e4d9e3c32dc2354b3a8a6e6481835a64b783a5ba4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:26:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9141
x-xss-protection: 0
server: cafe
etag: 6041988417631582345
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:26:07 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C166 398 B
225 B 45ms
44ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXQcm30JMQM9eebUoYUBxnTl0CeCeK-nK-sa8vlmdr2OMjqSHFWVXRHuLB1c2KPX8zJkUE9xrEAvm69a1bQfuJYnpVeA4ds75S0P_DSMrLONvptKOHguNiSLA7z233Nu17tRwxGNpNHjvgsngUiQP-pCukXGJt96Fas3mO4xkFlxNmRe70

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7B44 93 KB
33 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 7B44 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 7B44 20 KB
8 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7B44 204 KB
61 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B44 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNh4toO8YBmXLc9kLgP3pITkDpQSUcDPwlL8r4JLyCdR7XxJdJLjro570TG4HEeQmF6JkyC1Lare8pIF_aSVpAk5PjzGIlu7bdiB8cMNmKNQ55HNU

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A9F2 398 B
225 B 51ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXKHhuu7N834c7SpidQ3SojKHhYZbNXG6zxxLvNgjV_x0LnLwIJAzP78tJ-45CNSdgcfRt-q9KnNpzzl6J4YMznyBdVAjcipCfRT00t-9kFBmfjHXKcSnNSkJo3tNkHk7YTUrJBdgt10GwkbGCmmuQwpqK5EWMwg_GjLKxJfDQ9AKaqo0s

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D536 93 KB
33 KB 67ms
65ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame D536 3 KB
1 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame D536 20 KB
8 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame D536 204 KB
61 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D536 42 B
63 B 48ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CMv-mnMIs9TBR8knGIYCEHy1xzvjnlm4tzAbH48L20AMTphmA8EhnsceIXhWKuLiGT8iB0ahYMVZUKAz_xXHWmWpX_JBpc4ggxDc3L2LUGM2tp5OA

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6B59 0
16 B 52ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPL6BhCB94ACGIGix4cCMAE&v=APEucNWC_srshZhlReL4eht9F_mvtt4P1CRPgrWTaU_2JmU8phbZe_vhOgI5r41DwXg0YC1jTyQ2O9slnn4eLVaASGPFGOkKXQaqw5TxaS7S8quanjKPb5-8JZteuBzY8l3XoZxN3z8Opbrg4_Il79S8h2J5ll6KeyXvowATLMwAX25k1x8WzWI

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame F05C 111 KB
39 KB 69ms
5ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 20:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 20:43:16 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame F05C 8 KB
3 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:23:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 540
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:23:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame F05C 23 KB
9 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 14:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7647
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 14:24:33 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F05C 41 KB
14 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame F05C 3 KB
1 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame F05C 20 KB
8 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame F05C 204 KB
61 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F05C 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BGEjU4EvUodEHLCXgSWd_Q-397BTTEt4cNMTPTT_jMcStDWf4U8a34zvSF89lfJAwR8UfioSlZrPwzc6hVkoq9WaFrxLwBF1KXhq-GYz_n8pyxr7s

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9C3E 0
20 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6531709353610&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9C3E 0
20 B 39ms
39ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6531709353610&version=m202401290101&ct=76&x=1&cor=10555165476935340000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9C3E 94 KB
41 KB 66ms
58ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CCYYqHvzXG8wCETacMwMhM2S38lQKARZV_xVrPUUZpm9XcEkyfPxCAiA0IfycQwFTuqktJcWBsUBcwEWQGMCoPm0XTGcNabenILsFvzgBP2O4HeYwcYUY8onUGBcMTsOMLoKcT0aR8JIpC3C72GTwopH4dnAruFYjophgTBiVgIpagWPHSDW9sz-bjRNBammphqGl1Mx0FHzgo6dQ9hSe4rv752QYeQA5hsCuH7BrgF7vh95s&dbm_d=AKAmf-BK1n1M8cG0BR9T22jsQ5qGPMDbqh8wUW_tr2H3yuskNQKygrvKmupgtDwflx9AptRkgfkIlktx60_JqLQNxVUShqNijqSJ283pxtjcDQohN2Hv3Tg-zl_RfUdKNnumo0lchxfI0yhVFuu9NXA2OukVtpPtQ6DaznN7vs1HdrWBlkFsIpCWahiCocyxJ_AseHS3QUMwBhG1V7_CoU12-bXaOi1SXNzjC9QsYxIX3QLtxm8RxS1q3MD1jCPUpiiiE1FVN88Uh-dwJozgTGi2u5N_eRc50NBPxzcnQQGkNrRDmtYrU3TXCJijJmVjiEPzQVAKBNAuC5hTGqhjJhBBbIec3M5tJSJJoFENfysfjRAgsL2SLnGFrXxGl5IUmKL2gF5H_jOrvD230Nee9h0Pu8jyERHpr5KlLf9Tzr1579Xf9JV9U0oakxrd0n-Tvk2Sd4F3RswF9U1hwKPglRFC32G502TLO9k8HLKwBsQKL4RYNep-TGSF8eFA7LjzM9CG_6_5_VJmbtPDefOZ9SEf6cvWdCJu5N4Y1H8-SLqdYPXlKI6FQDyRV1SK2Hteg4R8PLuuZN_vov6NXQd5MytICWqh6ZHaUy8ZkTx9TxIQirhyPeQwPC2OhXE7vjsJgDwK3HQBcWvIsN1R94hZuQxilOewY78Qs3PBu1rh-SqIpW-jPsEksHtJGmmsH9oqhcRfjHyOGJeBl7BEuaJEIho_aY78audFbd1Mg2lUP_o1W8fxGGIGw2hit4XKR9uF1v6YwPNLcNV0pHxejEmsWv_j5X1wtcoj_mTd3qa_T1ZT78q3RhWPCb0pGyf3pa0LSZ5wHjUON-dU-9CQ3BSJoahQUMFutyvUNkhLpdo7iLbE8hRQLfD2Nh6ZDc5nriOnuZDvIG1nq2X4_qcg5jutMkUDDcxYHyjw6F7eunhCzWxFie7BGGRrPFjC_Hi3TLRTjlHrFZOmHoX_JbCj63W0ZX_LKmYwPoPBoDRZY7b_w9yeJN6F3nVAV7GmfE1LdtKbJprTEhCbdZgCp0ta58QNjO-UDsDwzKV2yiuzdaJaTml6jYz-QtsEnSjLnm0q9Ak1VWJ9Zob56MUhkxCjCpOxDVg2LHelbqEvfijPkqUAdUFNYArakIvD9Dn2cFNHsB81wFihs7yeIYvUFdalA3Kl8h_aStZZTkJLA6Jpmzyhz5WBXqw8ZS-cT9-f48Wdi3-81SebhcM7m4myUYraBEvQd-1IkX2HSh-KNVfIYsu8rrWbngh1lEdk_jKdqDGwm-8Z2ww-Onoe7ROy2V_lXhL-GQC31jI1DhrAWFrSi-aGbxDq81dZgOK65A22bkHOiYA37tnSf4xgUqRj4yEk0pA_Ys7grVJvSV80bgrCKNaN1G18e5nydHycdh14YTVtm4zshYpkW0IiXDFLGgMkqtNPA9bsWxGENRdj0JiARL85U4lpmFKmWchoVb6Q4MxSRV5OvBI-gw4ae4NOZXb1zDD7G_akqYtHP5YpCp4n-J72XjRNRJtW_PYkH2GbxLFitCbHGHRLLThX5Ft2ZvWpEJEzqp72w9iPG_zwOcLrM6tXyS55uEsfDRgmNIb8kBYxs8RX6t0y_IdgWOnYPDpOrhJ4uC6lcoWDExiZjvoJEbXwwuI7IzHtHUW8rAtgu164vZz7NkK7svjKxAP2P_gIXJ_a6nDZ2c8u829NT-ezgIFdxNAUf-IJUluXHwyOIlC3ugCQtFEpNDPmIzSWrCWTPzrVDkl5RBVpUrK8YfZ8QoVO_2Ye4D28jo-JJ7v_kg0nNmtQrwP93Is4FINjWbHSJ1kerwT0aU49Tc2oQYCKZDHn_-tzn2IcA-WsRoYajZ1Cq9ru5B8L4QLM9mbTjLkAf9IvDQs7BS9Zay5VumOeX5QdCqPZwfkcTi8P9s_cVGjA8aMaijNZoxSmFtklypRiPfr5_IzlCaeOiCM5-l_zqM8loTIvEGh-7ebXV5sa13YHswVg7H5q25LeUQ0tbr5scNCmOPzwfcQRpnnVAgnaWSAccZC913Ef9_gQ1R9SQVjWv2b_1-hcXUz0N42bsLaV1ZKf1CDzdjDTBPWpvDTuB80k7uebSvw3f3VabY9u4uhTlYOKaUm6h7dB_hfiIB2gi7X4tYGQW7qIp3Pe7Ia0xyRCnrWB1wbxZodQytMqtC1SCv188YHgqgIoClK6RIRENhf6OM3G_hVIixRYDy4xm63YEmtcm7OZl9qe2nnxgnbAvGlYAnpPtkd21oT3QxXXTCeGOFvYztRkHJn5IRW8lpOktJV2lm-s3hkFhjQYcs53iSh45SSChoFFut-GFfKPgPZvV1k-ukVnevuX9pErhx52PMrwswc77UxfFBUzedBqTulBM2_Bq5L5afHrVKz1MDt5i_d-RoC7cTtYkPFUyTWgk4S2OwSXoWk6QMkhbbwJC7S1IRsZGlU7M1WwLAHNOMWBIgJj5059nH0-JjIjD0BBxKlbCtkm1RuhQUKIPOzpTz03g4LJalHe4eYd1CGfQKCMwuu75Y8v0zQgqTMIrsOPSQm6ATKyuLuZCWz532PAGy-xgPPoTl69ytgg1fifXBsi1UrolOn_Uc5NobJKwCsM-uiy7bjm4OjdkpmJhyXTmeW8_CNlbvAhfbBQtCmb2jo051Fggt7Ls5bmuPlYdIXXvuzNfqqU69wwU2VGH4r0lZJbojQLTH4qjBHCCTZqcqKfxNUuC80QDkdyHvHBwozmbW9NFPbKIlXmcLef65_zxYi7AVY-Ie8pIepKlr0g-q5izg-i0xiSSpqyzVM9UnHIOgQ2gqZo6vH1FY-Qx-d1-RE_lymmiUVxyHGIWAezVYy0LI7B7qFE2yzb1n84r4LNZoczUOJl4sfuXQQnQiHj7tN4jTZrU6M9i8dGh9DDsTmQApKlIlyE5wMvF7M9nuHrBT3f13IcG5Jg-UrD6n3-U8Xl9wYFmQAgphmI6D2SdujyFCGmulv0BEf0tk5mLx0I67HbB1H8V0iZs3bFHU2oQffcSFiNn2ZSTAGcW_YtfacL3O5BJtLvGy7zJ8QYwB51J_8n8SXkxapYaTiEMotBxd8ZvTR7Ga1KVPE4RGQJsQcX4k6qNnvcWiQFyIurX8rMvnG9R0ZQeKfRxCjtRNh_VoH25lU7g2-gYiTfkIBYsj_zgdhhNaIx-CdkXjKVlSAUIyHm3VEwDsr1BJrzQNufxbZIGSlywht2aUidyQmsa0_hI2mEv1Q7fO5p5Xpu3SHEyS6TadK1avs2TctBXkfs4-dVbXAVFRF2sHRd-foROfjmyxKwt7kEoqgPnCfjDP_EnB2TkMmoa3bzpiln57xjcoKCQT1cAIPCRc_OG0gtSkzWFV93P0fIoKCfDZMAuW74zeIpH9DhL3Y0xEke2JsOl0kzuqdHrk4CWBy1cg0pgJoXO-Y3vIYQ3smdLSHC450T83vxaZRZFOZ_3EyJqz9AEm3FJW6Jljsq0McIz4YJtk17aJAW4MheHIs0LrhSyUXzMCyFzrMXxESFUtZb9Oa2sM3SLqbLSiJjmnHNekN9gC7HtCE7CLtHf6-m6z2shPaxGr2VXwWlwlZgFB2X1ed7TcE4alhvEiVdPMVOEOegA7-_s91VxtxSCkgYQke7mzazTdXi2bpTQzdNsJObYejhNiBb14VUAWs8DE1PAvqjR-h8YsRjRl4sdAuYOZ9vo0-CxSK8dh5FAocL-dqTBHMG64BEH94vCCMzMnQS3fc9nytz1Kjd9ZyIHnkDcTMWlmD04Sfh3SC2duryM8R-nyrZkZQO_uZj-ljzKKp9fqjK2T1sax5Zj27xB_vTAz86o2ld4B3m9hA5d1PDOLFWrvDBuY-io6f5RIxh5XJJVm-u1cJTNQBrFIZTU0RyJhoUZ-3prA99_Jkxje9TVWr6Me7WdwrSUAgiXRBd61I5THLzRJnSbQTU9R5BSDFZKZQDcnTrgoQiBpd28CKL-XfjmJQZ_YVBJgBmuZn7JU7D7tBpBs2GdP7aoC9ln4vf8LGT9mmP4yC_gCoB75jRNknCGzoB9MlpveRTgupb9gVbbNdOkbBj4wxtN8_CWgCTGo3_oZFBpcGyA5yBZVeJs6A&cid=CAQSTwAvHhf_64GpKZukmahSuPYJbZDE8pZtzQvjZWbzvUl7uBp8JC9Y-rJTYgJUZxGGsf61Oq5ZkODP1kDQRQXwCkiZSpm_YOZeQigzR-A4Ye0YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=10555165476935340000&adk=1964084971&idt=51&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3efaa09b353ff7501f1610a8b630208be31f21d2c15bf9d8d8fe4ccd3a7250b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119672&bpp=1&bdt=832&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41449
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 15F3 0
16 B 65ms
56ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNW6CKpGCOXaXOrcfzXYKEdytHBCb--rOe_Q3Q5YD8HHEYsilE7hWtuiZ3mFv8h4lbq54BvzMzLiz-eQtIcVLKP31OSP6W3ZJJ-1ylEshR3Rk5Q2hdfqyoPQQMwvyHnp44C1ckkQwI2eGDyb94I6FQE3YtmZ522eLTtRNSDomw0oWjAYULk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFA6 42 B
63 B 43ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AfrB4QodE4kVsnoYyDJ7ZAsIOztCKvCO_qVO9zxjOflA8n5rhqLu63A6XzL0Z2GE07rzd240Jva4Lcw3k2GmcDFrs0-nCperSWfF0We1MAy__E_Zc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DFA6 93 KB
33 KB 50ms
47ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame DFA6 3 KB
1 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame DFA6 20 KB
8 KB 13ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame DFA6 204 KB
61 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 9920
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1

43 B
61 B

18ms
16ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVevxAtYNfKsEJL4PuIn5GRGGnWMX-TUx58GunGRb8TNdPii19LNiJiFJ7ZscSsSmEmWJ0iIqRIDfKeofr2La6JgiSihky83jC899ava7vEr28l8iK8pMk9yGI8yhIrtg8XM6K2hAmHZCXLHHFRt15tH3ai9M0fqBiKw87pFfKi6FzlMWM
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 9920 43 B
111 B 22ms
19ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVevxAtYNfKsEJL4PuIn5GRGGnWMX-TUx58GunGRb8TNdPii19LNiJiFJ7ZscSsSmEmWJ0iIqRIDfKeofr2La6JgiSihky83jC899ava7vEr28l8iK8pMk9yGI8yhIrtg8XM6K2hAmHZCXLHHFRt15tH3ai9M0fqBiKw87pFfKi6FzlMWM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 9920
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1

23 B
163 B

35ms
35ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVevxAtYNfKsEJL4PuIn5GRGGnWMX-TUx58GunGRb8TNdPii19LNiJiFJ7ZscSsSmEmWJ0iIqRIDfKeofr2La6JgiSihky83jC899ava7vEr28l8iK8pMk9yGI8yhIrtg8XM6K2hAmHZCXLHHFRt15tH3ai9M0fqBiKw87pFfKi6FzlMWM
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 9920 23 B
163 B 73ms
72ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNVevxAtYNfKsEJL4PuIn5GRGGnWMX-TUx58GunGRb8TNdPii19LNiJiFJ7ZscSsSmEmWJ0iIqRIDfKeofr2La6JgiSihky83jC899ava7vEr28l8iK8pMk9yGI8yhIrtg8XM6K2hAmHZCXLHHFRt15tH3ai9M0fqBiKw87pFfKi6FzlMWM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E83C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1

43 B
61 B

19ms
17ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX7wdrNDobQe98lmcjFOeVY9mvxmcY5ATChaKdZzOUUxiPueST_iXNHQlavz3LuI0jkDQB09KQPTjT2XYgOkfA1OEiVkKHrphjUlsFfU6isqSPm7mIRIWeZrTNFBOI-yq1mtcLSOFtNvOJjsRDSyvy7xZDRodWedWbiyV52Ef7svRSUeEs
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEO3hoA-nDOKURnoLoXrp2AQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame E83C 43 B
111 B 23ms
20ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX7wdrNDobQe98lmcjFOeVY9mvxmcY5ATChaKdZzOUUxiPueST_iXNHQlavz3LuI0jkDQB09KQPTjT2XYgOkfA1OEiVkKHrphjUlsFfU6isqSPm7mIRIWeZrTNFBOI-yq1mtcLSOFtNvOJjsRDSyvy7xZDRodWedWbiyV52Ef7svRSUeEs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame E83C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1

23 B
163 B

34ms
32ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX7wdrNDobQe98lmcjFOeVY9mvxmcY5ATChaKdZzOUUxiPueST_iXNHQlavz3LuI0jkDQB09KQPTjT2XYgOkfA1OEiVkKHrphjUlsFfU6isqSPm7mIRIWeZrTNFBOI-yq1mtcLSOFtNvOJjsRDSyvy7xZDRodWedWbiyV52Ef7svRSUeEs
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEAUUwoEgybixI55KwCdeoqE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame E83C 23 B
163 B 36ms
35ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX7wdrNDobQe98lmcjFOeVY9mvxmcY5ATChaKdZzOUUxiPueST_iXNHQlavz3LuI0jkDQB09KQPTjT2XYgOkfA1OEiVkKHrphjUlsFfU6isqSPm7mIRIWeZrTNFBOI-yq1mtcLSOFtNvOJjsRDSyvy7xZDRodWedWbiyV52Ef7svRSUeEs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 16 Feb 2024 16:32:00 GMT
pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET

partner
sync.search.spotxchange.com/ Frame A2F9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEI7r83HOVP3jegEO-rDbBh4&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame A2F9 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame A2F9 0
125 B 96ms
70ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCl_qUEEIK_m7MEGOXWkvABMAE&v=APEucNUvIhUWelC-BOfV7uRKmnN74sd5mShGsx-zbKaei93dpO1K9B_YTXSE7stu0B2qiClYxMO2GJ_9z9Pw8OVB1K-aNu8NYjK42lXChWtKVuOw4jIFxCrqpA6dUt_Z0gAwdzbhICwN2Q2vQSkpoO05fVe81CZH8fVa9s52t1wsG9TmHTFezQQ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame C166
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1

43 B
163 B

63ms
27ms

Image
image/gif

91.134.110.136
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXQcm30JMQM9eebUoYUBxnTl0CeCeK-nK-sa8vlmdr2OMjqSHFWVXRHuLB1c2KPX8zJkUE9xrEAvm69a1bQfuJYnpVeA4ds75S0P_DSMrLONvptKOHguNiSLA7z233Nu17tRwxGNpNHjvgsngUiQP-pCukXGJt96Fas3mO4xkFlxNmRe70
Protocol: HTTP/1.1
Server: 91.134.110.136 , France, ASN16276 (OVH, FR),
Reverse DNS: ip136.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame C166 43 B
163 B 88ms
25ms Image
image/gif 91.134.110.136
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXQcm30JMQM9eebUoYUBxnTl0CeCeK-nK-sa8vlmdr2OMjqSHFWVXRHuLB1c2KPX8zJkUE9xrEAvm69a1bQfuJYnpVeA4ds75S0P_DSMrLONvptKOHguNiSLA7z233Nu17tRwxGNpNHjvgsngUiQP-pCukXGJt96Fas3mO4xkFlxNmRe70
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.136 , France, ASN16276 (OVH, FR),
Reverse DNS: ip136.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0190 0
16 B 47ms
46ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNWJ-hWg6SfvF9BRPHJO5co2_UgUktIPO3m3k9DbjpDbnHk4AsPvMxF3msgajz_9WCPZPyBO9y-qltaFilBn9Ig0lt4TC62WP47sPFF8xCXMCW-cqpFFZf8VggprbZLhFqTErWtpHdFhE51RjfOi43pcXmtIkZ-EiTOm1DJclbmJyNdEHSA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 1418 30 KB
11 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CNeOw6j3E_3Ktq_vH-o6axvbiUcZQ3tEEDKudidWav3jBMdU4at1HrLzaNa3Tbgd-oh4lz7DECB1eIFM38o2dSIV01PRBxNJC5GVNMnrMbhfLNXSGvCZFKsDFM0b_iaY1egr7eayTGxN8BNCg79Laa1jdUGUjlGrd_I_7yiPsJLKFsg_8&cry=1&dbm_d=AKAmf-AA8B11n8xSskNl2rQ4YsUi0Gx4FJtj84N8E8EvR_g9gOsaz2-fk53DdFwBsKTPutQxgSxnu_Ma6wf2__7CPKE9912yRakOZfh6C8hz43YOi7tvSHtlXRZQVyqhm_GgNsFwNzRYtIyB_ScLlIoR0CmGkd2jImG6M1wAw2rO4AAUezDaUKZc713hqXMhBpdJrjC53ludyxUEohQ4HCdSohmpawHG9BnCVAJkxdlaQ1_bEsxuk0SNk_ZVHbrIjLqi_A90cFFP2hUDlF5dnOXddc9pxqrJlqlt2_Fy3LHBN0wMC3k-GCGmRc-6xHsqTzE4NnUCKfXYhoi3kw-g4QGM2Yk81VSWHW20s9t6jwCZcc_TqODpW8as_2tTATPckl7gDLNvK_tywTpB2t3LRgfWRraSILFFCqDVd-t36IBF_-vKxdkJ8M9BFt-RrPitQS-SryVDsdhGdF3INUx8N1Im6qJaqzGU0MGoMZ2VPWY0QL17lD3QpABsQ-ORtDR4JQt73mYwCNlxNjfBahUCUGL8YWQqBOjurX2--zRPDr2HQ8fcsIhM-yelAgcqQ1pccJdzXEJixjivX1QmUmtOb90rtJ-REz_4_nXpuXuDLCy08L9bsoasndABl4HmjXZg2lGj6uj5XwjS7UlRnNos6lTCLPvrWVuCXfnth3LcR9daCkiD1VrbWsJT2J4OP127O-6k8dbmC1rWOIjiHHEb_UxAbpyAZ1XEhdmx98Ybz5obQ7-ceR8hi7jqqK8y2K0bHfPASWOQqX_WQLigbdMbsHPT5V5QX59qsjhSH4aMKVNfIW9ewghK0wfLDLP96NIF3Vnme2D9MpToEBuh3HA5iHqzMuWGe1IH4IfdFVkjyhqhzzlJBTvBmWlNJ7zTNy2BLGFf6CsC32G97PX1uYijRiT-ZhnYA5guPT5zvpM0CdVq12g3QAzzHIpnBW3GHaevbZnZwOLkgWZfa5S2gjIboV8BFycXKcxWyRuaXnNNLZqW97fLj1IuiCFx3SD9YlwaMjlPb9WoHg6UNc5fM2gwGgmoJzkFe1xv0H0KCISVpPfedyq8YEbM1IJCMnbcZj_TZ7q7MvwpclYYDW30iham4rXTId-UYwj4zBbZD_fqTlhSXVHBfIDPlbUO6QoQt8eNscGNLIrbwGhYBu_UEIhNaSNkApaLv6S1bU04T5q4oZRZeAEOkKwgZdo7GEx9wcQnqc3MZ6giaDNthY4UiZHCyMwvQbtmIm8RtL_aPC9JADFgUiEr69ov3tXIy8JHBLZDOzjtW9DmtRiVG1ZRmlYy99ZlZkkXfyrWrRwcP-zWMsbl-pMz955qf6OPuPEFFWctQKxJabFxE05rVFNT02L56PIkAjyaiEmWkOKJrnr1Vrog_npMZluZFPPg64IRLIXz_SqWWT-Ko5XppoQM3vDckO6rqAMoKekHocu89X0ner6D8AnKp0o3zHJjWIAVvaH7nfGmsp8FH0uM7Gr538WICPEceuECN6jSYa_gO-x7TOcC01DG0Klfp09OfueuX7KvGr_XKB_HUC0K2DVjGk7iaBFTsgNDE-Kdi3pMoKXcPC0W8aN9tyVkxDKESErbH2g_tOtDZN4Tk5xG6TRbeoLYrdJyY_ezC8O099kTijzOTqtUnyVNLNYaJiouySIVSEgCT8gvUAOmGnqdyt8_HC2HvCBAlLi88FJtecftyStU-yTIf09VdJ09ZXVJz38imcttvGpskOz2hupZJEHaNwIcQkR8-lwGbHtBtOyNNkJ8zbZMXxpNhYIjLG4d-Sxc56RhKAkiYFTU4sb4YM8AP8MnQwmXUdhgOR4Yn_og4FKLu2OK5IhXeyk-tNI56YCSw010KsJIX2Vhf3stY2MTe27m6liOqT3tPQgNzASH3ZIl3U8tP5O44-Z3zaYesrYBr3MG7VG9eTQ-FIJCFJv7sJ57T2a-4KTH33fLHWBn9N7GL0JpPnje291qmtXrFVF7e_PGPS9RGtI6AaTb9xOizf4KQsBtztdQfNXdU77OAbYUHD7eeAMlB9DrxkS1V5fjZqVFfcFq_FZ-AXrZpWxIB2DpQuMvI3idc5II2q43i2X96wjgMZv25ZVUvv66-0cO0yNlos6DQZdfil3ZKho81YNe0G0K-3TnzBK9cskFSxDWa4gTu4BQ4fcnyzgS4xwaaEIyK-Nrx2AIEXN4OmcwNucFQDFFW9m1fOU5N8s7PqoyJPTPlUE5bEH5LTRluOp5iYiS84oN5_dJ3IS_iHA15apkRY1YRTfJih8KpmxCzCtYCpZPd1y1EiiwdkxA-3JIyprJIWPacAH_WqSPjUzMCAukFV022GhQJjSvWaOa7Cw9FYHWBspbzlAPf6g8BVZGtrv-Z6muLzWqEUV5BPQvoxUXEtpo5j8sfmKQyeWXxigY452dT74ShOFb1AUSVmR15AWivaUxa26j6wAki5dKrfXV6duYCOQ3B12BI-gupNJcKiyEkJ59Qz4AZRbSIjgydvrLzGn4cflL3l4U8FvKoCwreLr9LZIPJxkHqCTYDBGpWxhOYacUCGtOAgu6Q0y_rPR7qYZeWLUqsAKToXGMa16DvgyaQlNx2-WxHF-CpH8xHfBglEJmSzjyA2M1x-o2CX_ZhdU79qmiK3S_ImkbIfblPJS4E3tGyDmohGUgInZD6wFw73Cmne5FT_bTxcgSwuVdjnPmhWLbsdDxR3hMMrM7cECanGX3v7sVbZAknxG-Whamw-_C6DE_0ktcTBWxV2JWkh8TFRJC4cVafyt3kd676krYjDFxNpW2K5yymVeO9NNrvTDP33JkQ_GRrGC2xRkPxfJESsvSxVIycsJg29J4YznuWVbP_4faJVhxvj5v2D1rNGSJ95fmDAbOg5PQXm1IaWnTknn79ObpY2HrYga5LlpmoWqO1Rby5ZH0RhZVoTjbQnJR5B8EKBOhYV0zAe5h8olG9T8nlGcgezCaBFfZHN0UYF0olMe4eCsnCByTG-jPYL_bKnygeVGVdEMaY9W6yi9U6NRa6WUlkL2hq7um0JNQdSt6V1siV0r7vrRgGXLJ2XzOa4aCVHrA6t-MsFlenBGxvnPkACpYGrjQGdkyib20aEP5G-gN-8xSNYAqKSQClFDg0nsjHdjXCwqyHKDlgwDjdyvMqu95iYT0X1_7UeUpUMzbuqcx7fp8emr0jGCr3WD8NuJQLhfdAIqGRszEjKbVImgyBwfTIKnIlqBRnaEEhlXtHEWytBcHIuqoCdfg8OnX_9nOsknhHhZeAwtTBEYacJdsEyo9adbbJW8zEqK6gIDMol0abtZmcwdm_PiIoDHsTL8Uh5Sut-NXZ1KnOoBuOJBu8Kkmq38RUiHYIvet1pe9_1s51Qa_OWNTRmiKjAKGVYBpZCNDb-AxPMPQJcL5_YToxTjlJ1QxswR8N295d-iKhp66yer4jSYPfav60Q_WPVZVw8FSwwVefdfEUdnXzQvPDPaJPnzSNK8lx6hgH-aXbBmke_WQPkYx3TXib64HnhPTtvMtN2YUKZ_ebSpkxPX90q-H4JvF8PzuY3jAwNHbkT6QTuj5oEtf3YL9V3I0b_IO3yKOCsUNbbr22RHtVEutq1AWW0QMoDnluXOyq0ScRnOBF2AP0tz9EjaPM9bcdqu6UhA_gr6-tghZF33HL0SkExYgZcMGpGK0n69f95BjiPmCl8RWnkkQWiJY-CgukjYZSWycSrxxJEeYwb3gMOmVh8LpAM2i7Fzj2JIAtDTC2fn6O92iZJ1ZJHew33tIrbhRsxNzCdkDLbJZGc978aJ8VfUI1dPzTjbyRzqDz9YVV_keb_5op65hos-pHyTVEivgxm_U1h86a6Gplpixgj9eSAtdbJrfDrhpbUiSvNNUVHUoTJdUKsyke7u86xcWlgf8EFcSxcSAsK43HYnAQyO6FtCarAFnjBrp51fETtio09Z-iEUNNTA2U_67-tUqDNdyPRY0GuRAzSuKLgJK2qKDGmy9b9gI6PQDbIJqO3hCPR0reG6L5CCVI4CMKriI_JRY8bm8ttCCLkqUI9BmbTyOCEk6dYLtcwnhRzWRYKv7APTLgXVT1mlIA1FBZR5zPMdk2VLYSjI7vIXXvYWOKeBLHOXTnilDNtAKbc54sb7Y9h6pxDd689Jhn9Xp_SEKvzveUtpcO5kOLxje5cwKpi1mvWkY0sRNe-XD_bKNA_4-6nZ8-FkMhnFnpO-OCIgq5ZmVjLo&cid=CAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=3736979346438161000&adk=2857193499&idt=53&cac=0&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1418 41 KB
14 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDQyNTkwMAogIHNlcnZlcl9pcDogMTM5Nzk1OTM0CiAgcHJvY2Vzc19pZDogMzg5MjQ0MjI1NQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 1418 0
867 B 87ms
42ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDQyNTkwMAogIHNlcnZlcl9pcDogMTM5Nzk1OTM0CiAgcHJvY2Vzc19pZDogMzg5MjQ0MjI1NQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMTExNDA1ODk1MTQwMjU5MzIwMgpkZWJ1Z19rZXk6IDE3Mjc2MDc3OTE4OTU4OTcxOTExCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNC0wMi0xNiIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc1ODk5CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDcwNjcKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjEuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMi5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQKZG1hX3Byb2R1Y3RfaWQ6IDEyMjcxNTgzNwo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"17276077918958971911","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"11114058951402593202"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame A9F2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1

43 B
163 B

61ms
21ms

Image
image/gif

91.134.110.136
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXKHhuu7N834c7SpidQ3SojKHhYZbNXG6zxxLvNgjV_x0LnLwIJAzP78tJ-45CNSdgcfRt-q9KnNpzzl6J4YMznyBdVAjcipCfRT00t-9kFBmfjHXKcSnNSkJo3tNkHk7YTUrJBdgt10GwkbGCmmuQwpqK5EWMwg_GjLKxJfDQ9AKaqo0s
Protocol: HTTP/1.1
Server: 91.134.110.136 , France, ASN16276 (OVH, FR),
Reverse DNS: ip136.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:31:59 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEGhDTFv16XCknh1DhY7yVDc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame A9F2 43 B
163 B 80ms
19ms Image
image/gif 91.134.110.136
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDy79cCGJL9n_oBMAE&v=APEucNXKHhuu7N834c7SpidQ3SojKHhYZbNXG6zxxLvNgjV_x0LnLwIJAzP78tJ-45CNSdgcfRt-q9KnNpzzl6J4YMznyBdVAjcipCfRT00t-9kFBmfjHXKcSnNSkJo3tNkHk7YTUrJBdgt10GwkbGCmmuQwpqK5EWMwg_GjLKxJfDQ9AKaqo0s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.136 , France, ASN16276 (OVH, FR),
Reverse DNS: ip136.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
transfer-encoding: chunked
content-type: image/gif

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 443C 0
20 B 45ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6521390526716&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 443C 0
20 B 43ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6521390526716&version=m202401290101&ct=76&x=1&cor=5466578710995754000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 443C 94 KB
41 KB 86ms
82ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvELFKEPqoxsYzbDd79UnedmOoV87sf9xCoV1Ho_fC1Mx_ORsbyxn8Hm3OWz3ng7aqSoeMou0yIClxHLxIJ8nundWIxGM2NsbQYtYkJ60XFMp6L0adC2dvDdisLVIy7p4ENRtBFGl431o9lIp37btuz6vPcCxQbDEQ8Q_aoyE3B1UKrMx8cs4XCdah436iS5ftjKsJRxsokTvHW3KD3iQDga9Htx20af0zdV11KEh9QKWl8X8&dbm_d=AKAmf-DM2FcjlWLj_vYSAGmnt0zFfyZg-qcxjIw48ir19xYIVkr_XOXsk6zQSFF1irswjw3_VIgYVj5q1DQrW8uWLbqoktq3bD4IiiqQWW50NhzJyq2sCBuuLgPFyqxNfWJ2IBMdgXBNdSFzh6BNGmgHva7_02sgPh8Gdop_3uw6IciAYzw25wlH0cXSzzR7w87B2ASvi1xMu0YGCiKfoMs2k8j_n-_VL8AKVDWOhqplhi-shG7F3_BZ85z1BQZEbMUHuLFGsSKPXU6ZaWiXeM3X6mT1jMKcPp6zhu0sm04YI3cU5__qBjUTB9MLvV0hEXxRaIN9RJm9DmBFCGVsClj9nkZ4iKM-LBnQyKalxlc5SshW2rUOhZwo9UGj8LdCOXxF1_6VpNDbKYLOuaC5zitnNWyWvFVpqAeDTT2b29S2p_3J00h7vdZFKBnR5TKbPVI2CNG6u05MIdFoT5x609RTGG9G1er_8etn_gB6HrF0kblgY_UPdeP1yPbpjZs2LSztKp66io50OVzoEn-JbL8qmfXAM0NIyPeheuQSCGtzFMa2I-CNrvugFVrH2jEgBYGlPkDU1VSVUbiapobiziku91HzmvKYx1ISFD8P9XFEX5djN2QdGYzRLhnGyX0b5c7yma10ZFeakqjPwTTDIFQoJlFsojiPcvCZ4o5OKIoTlJuYrVAZ9fo-EeSegqIH5VwFkkvb0JxDvCfyLjWPyN7Ug8WIi8MY9dtUXfaqAj3Vl2u8GB73cW3fWeR3ufzcPY2UkysUf2JzOX-OLNIbEBjvWpIX25x35E-Ug9udNpo-Npp8IHV1tJp6AARXdfJLZQgntCRCmBGVQ7aIH_voik1ZrAysL1HERArtFrFnOGF4ooRK2mC1sZsfUdcFiOxH3GubqXjRUX_vb124GjL7qfBmxoMMy9PEwCpYPMFwA7WoXrl3fcWJxnid6OKp8aRXvKw8U9IxTSzIe3i8aeaNC_nvSmnxlr1pgknxHNL1yrH9C9nc9FJhF8UdFQtXeYo-qMxC0TUHAVkY2wUrBJuTxCtJMJ2nCOLt2Kmg0LRtNKPRxdWvOUFf0YBL3mPTMt2nsclhov_Iy8RN8Pvn5n_0ptKj3K9GYrk6TtV8wIMyX-zH9KyDzivEIN4_s-1QeuJAWMGO4C1DpTVgE3SZaHJUKaycHtEooFiopC7IQaf3lUgk45o3uvg7LQV7_6Czgp1OCdTLazVQnNLZ-XwVO0P2KO0gfQPvl19HUve3IXVAnDrBHk9BGlQILW_vzbfB_kX7s6Vv90ekQRLoX8L84M-QEIxq5o99tW9Cyzc2BvgJuk6-Hl82xGKSOj3ZtYLruD7sqdZbXt_IKbn1lwb435om5zr8iV0qRezyc2PwsnQwEaIezB6k57cuAYUQQoxVwMk2JEETpmpS1QM5pLnijPBIf88wqa1YmMPq3HE0e6cbAQF6Zz4XbKc9iGr3d9IbUvW9PBFArmWpMnHDxP8AHKrcK24AQFs8RMQFnjF8zcxnsfQEXK6fl_C_lDVb9Ae1f3NdWbG6BBnsjVL77VEpk0Q07cxT4gdqEKstMs3rODS36uo9lGu7AhBPGYRT2urqwe1gLRgoHvc5uv6dqFEXbVCbRBhS2ytC3WMKubZ6tMgRJNMQhsSAhAxoc3bcBmUZf5RKz91KqgSs2YmOCT3i79cPqM1V9y_XQHnoKSl8dLq_AyG859H3Jm3uL1Vu1KEpNC1rNzommTEiSufr6k9xz9kRthwM4pygJqnch3LtYQJLxZD5wXljqPhPTaJeSyRwN_Gnck2L2EYi-g-noIVbFH4aSep6LW21SqmBR79ytij-4MK3nIlEDrxYJJVuceVLK-gZCivGL_LyjGuS5XUMFx8I7AEVsCOrbTNkGEIWCeq9dxLKZgDPxMUiaOqecxTAetWgkhm4R4mFPw9jvelPLkZTSIfTvc9AUa9RDWSRqnAqQL-1J9nn--pB-AxL8L3fTg14ckPTY-QglyEUf4MNTp9pM1ROI6Fz6x-YFy5smFijv4t9Gv1FSEqIJS-SAy7eEptaRNyc_QZQJAZg0pBoIbUwvu_RfeNnOXpGFODwSbj_yxt-iVf1MApDgnEKxNokbi8nMPOF626C_UxyWjD5D-f4k7S1BnIUIZrUKF0HIryNL3ZDIR1A4XnlRTq34gR52oEe2rDFqciWIrUil1sBfvYoKZ8rNXy9lWUnfOvXqCDu4s4YjDtWp3lwOPxaQ05oWtNMOlnyemZgV0c1TI2fLywh1P1_vFYjPosrVtXuec5U2acrhxBsqs3pG1-Yv4WvS-L-1AgRUYShrtU6VTUTSbHBGqqhS-UlagTltrt-tWW24dNnlZ-D_8Cm7_lk9kCXrVpJslzYqPrwUBQB5nxAD8wFf-wEk2NIyvt2EIS5xN3ATbfNePPwUmUj0d8R_9jWnuBh9B9Sbk_XEoV1eA9PtmR2957hpMiZxX3FGwCDpqNswEaTLb9nv8XqhXjBf8bvUwlUDM12QElu6Ngu0okVaW1DMHIsglntmWXTTuTq-QlA3RNnBkR43ThVzhnb5A3RcK0fXJFpUXVHfP-U6bslWfMEfW-J9Pf-BtU6i63AhLlARS98PdtobKQV-0rWdjRMUAx2PMzGX_Z-ITOy80dr3MPFLKIzF9YheDt7VTFtYFSFOEu3ta-UyjRMKyiBWkVThRh_gbRHaV04yqzvBnf_nIDmsEmnMWVoMvQSbE5qbmnpnTHX859tZddhyq9vOrhitL1lgWLA31yrPuFIWb_K2ZjCJm_AQ3YArwN9ZkdI2vWaYP1RA4r9cyw6Yf2mJO5-5Bd5UoR4wOwIdKE4CIY-52fDH7I-CS9Ek-3Pru_7LHAYQEulKc4Qzb90fEdjSGwZLqznWA2GZpaQvi6e61KbqG8UdpkD2KSkIi_6skHeHacka7wklniQY1OxnzbEF1jYBVoXFWpCEZdM63s5hkR_Qh-1O_I1pmfw3KKNi8zx-VY0G7DI4_O5CTv7R_7cFopUYcav8LXrboOUCdL3cWc0xvE3BdubGTMYPY9Ffqufv5GDeHpt-ynhiYxpPDWK36cU8L-4XKCB4kfAY-q1xi638srhz7EZDrWoxJ7bwuazYhfjVQADJbZp0l5_-FOYd9co3rvpp8NvMQxr6MesrZ8r-9BsL6xMwZJtxOlj03Mxk3a0_2BdelzX5cucfsMI8gKcjexMkd7pDNIwTMEHwggrrYJb9QsXd4Hwtz4zesKGGvtl0nuFr-ilxfbfAuQp0PC3VW5knWeDI0xIwViMonx65pL-OeP-z2ymr0nFL9CCuy5ZgDpNwyfpeQ0uj-F-lYQavy7XiNBCyWW_sx19wOR6gxDQqUg0wEtP8rc5Bhbv3kBZALMmUzmefPY2sXHgmF-pTBrFz0F3fm4DeNvvyvh4q-tL4m5ckLKWlvYU3b9NUN8eVYhofRzsA0erpCtPoXr3RD4x2iNpKh6MtDrjdtDSEZWO6UJ77PXxNDIOV3rfiSN4Qau4sGzhU-632fC98dfXg7kUs57Fh8AbAUG0BnEt0r6Oh2EujG-TWga0Eaiof6iUwLtQ3JuL11Gm3UXetf6pDDF3ZLXaeiVYs-8fNNhzIKlicHAnRM9z__7nJDDFSQJBSSGrtHFOU5OAhkDmmu_3IHNGC3t4k_95U2Ab9VV8OomsN8joix0OWttKmUwcHMKMzd9kGDPUlIufRtO3c_X2ccZ0Ba5cpNqEm7FCSN6fS0lwyCy3ld1Pb3ybn5kMCYlNA9hR5aad9txPBZ_8k5PBu-_oqhM_2J6yI6BRioeeBtzzZ1HDomI77PzxrNVIyiWvIi2yuwmyJmNsavnO9C39Vz9hGPQIKR9srxg7vY-j6KSB1USeElC5zjubP7AizzSYxnYp9h_Kl-f0yYkHBCXj0fyxeFKPnwjzUujSC2EUxy69oRfNn58PmFVeMDGoydk0DV1FJjM4Lq9kKqr-ZoOH11jrJp80t9Mld1B0D1gsrDe2EPsiSoMuIUCLlSTU62-XcA8l-kdpTI6kFfkBI9SJnZa1CvVWXD5O2jQ81pnZdu2WZej-D_WJF4vumGBsiTRTizS14GOLbW_4YJ8&cid=CAQSTwAvHhf_B-4l2LhRglX0QsKiqGEuGjP18F2kNQAqLtqY017zht8jeGEGRNoE2CQez6Z3LAUAyVa0bKEFp_lNIOIaK9Ic_bjNQBHhrD9H5cIYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=5466578710995754000&adk=2228999114&idt=69&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3739987a9744ea65ab9c0cb6a1f7aa36e6288fa9c3f5e92f8534fbe2e057cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41604
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44B9 0
20 B 40ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4354822595506&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44B9 0
20 B 40ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4354822595506&version=m202401290101&ct=77&x=1&cor=8290205236407341000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 44B9 34 KB
20 KB 50ms
47ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AcE5mRsujIqV0VOJmvthyAgERBt0KoCsT3_upcQhC0riVQbH9kIHZvrfOMLPD8h-jNvyrAIuVlkfBERVxZ_zSYehzKnNjvoTAB-yp_aRGSvpxuKNvPMCIHP0MnwJUVHo9UMlROuuutroeQdY0iwOaFwgeporc5TTTlvXj50QQ3Op_hV_M&cry=1&dbm_d=AKAmf-BVbQ9bIfcU-smjLdWIT5zWk1-8OTM9KkbMayvWxGqsrIBoEP3wBqNFCnvH8PIo1tTfCEfhayYfQ5wLFntYcaJmyXZwAyG0r7jcnQb9PyTd-5wUEhk35KeJ_dJ7Oe2jtPJlubiQIktXJIjrWbWKYBHJyLhjjLCbj894c6FYRvDlq_yC1Iqif_IecQuPuSmfLqb6k-fnrFyjk4Xv_bmWpoa0mtXNi_d40i8B9miPz2TKVDAjSCsqiggqunej68yJPgaQ5mgTZROfTmFVvg6t6DFOmY8nhk1p3dA2_yv7nQW7Zp_6Fo03IA6Dukns5R-Y64aGKdEaQ5AFr_7fHJf1fdbfwypzMpiZvLEi4F5HLb3dRKeZOWCwZgIyQNVnFHUBPo4SVwP_Dlf1_mflYiMXo0yQAKK-CRXtK65CJjVYeYHPpk2zeSi2IUbg-rBSt82Ev0-rO6s0JOqKvZ-pnq66mSIjvp0jtrx2_B6VrKIS6QemFdDxy93l06Jof07zTVNlXINnbbcdiB2GMF_azNxACaIM94goXgh4OEmqA9pKyOmFcKJQ4MroUtGFG9kU0_Lb1g437LP1l9O17XvQhXGqnF4KuD865VzwEIzzz0ElEfeRyeBLjCYlLb09YejIwPFghcHrz54VC22Zhko0t8M8MMJdtpQtkL8IYbV9yDdCLFYfsHewXZ8xzsALvJia9InA-4QGb0PkQTZSiXn63mC0wHCQq89DXzcIksDl0XnyUbKyCdXvnLTjIr3PZaHrrOaYfarirq5cvJWoOzenlVs8XXVG1lT3YzTDtP0DeHNytcbXRNq5jVga4cWWBAQKugAy64KEOln7YiX0e47DYIxy097hFNTwTZq-wd_3S8_k1lxVUfuGpd2rlKf01KYznu1lLYp-72iiUGE4YqJCATjWon3OM_8MCMFtaFXtjBcFrQs9L9U0qBb3LPV-0bn98liYV7dkzWGODBNuoFok3GVRuH7Rx2OBtoZFreDgrrGbsoloZOGiDNyK2_h9OLhTKh_knDIwEPJEnjqAq5i9ICCBtdo_c20F5w2xgavuJjB859D0cPdNslMZ1iH_goYc8zOArk81Z21bDPvTXaP4AP0JkojS18qn7chC2iYwUxcRdwBNQB0pgkWqBjwDH7_NnXvO_GbReWWABzgJI9Xq_iFP4OeaWsyxxF7CI8luu63lq3P3Njzt1kfmH9ygxzKC8aBYSHogkBpTJrMP_ByX91SGFhQuho0PZWTcqEToRu2-4sQUZ-eaoNWATbAEEFjk_ENNjmxU2o3U9RmtBFxy-HTW3JBufmbneZyttw3vlJa1bpEm6LPGj63a5m1-9_sDfG3npEQnWyJ_dYbTrkocY0kMFc04-RleaWrp1vq4yuw8_rOazijxoSNPdwRcMYXGBTeA8POMNLg4RdHdJ7VvUibK8sx9bjIlxdcVLKLVEsBc8oNCdHf8xpKuD8_vKqMZKbsgHVL9jmkSh-1yVKx4rar10mJtcCVqIkz6UV1WkPd3FSxe84CPLMrELRiaOl1UHpA91Q4bxaLkyUGUS6tCuwe9b-jkR_eDRqxKdCobpPTXdOoV1Vhn8xs-IGsgSCqYZKKPgoov7pg3P0YcMjRQillySe-MEyKzY_6BSydLY9tu1l-XDiwgizq6x8v58F5rbvwGG0dw79hiwkmnI1iPr-Z0a7OEoAip-HPERNgHOv1Sso5-ozYpLUuGZLStehRAj-ywb96G43y5oCH3E13JgrjdgMa3SckF7nPLuU5Qf_oQo6_-XqkmJRQtsmHvkjFXoCNKOR7exfooo6ZBXwFCqAqnDIcL2RFN8cw2NT2ImhivM0PVL3FxEmOJ35-lJiSt0W8zZ0GsI5jSa-r0z9Zwos8TwujNMzGkZmnfdg9x57JWOb5RDWSKvx-sxvzy7ItNrf_bzPbzPdtEYq-YJVmzIJgeELVaXVWQj2wHQoN7acpMh1l5QnN2RErC5akQpKGl6ckUPkiVtl_uts3Qjy6thKgUvwnoRXTdzU_mp5bRbTP-elrPJee7K1F-87Nwag-RTGOwSooAW9uGo-JRRRuLQNG7TgRPV7PgXaFrEGhHMY8efQ615n6X6tlDbWYCIMmCoSalhTD4jeVpee6MbjukvK17Vb3XrQJzWbMbg2DKMVH4PZy1PXAbnZIqwhgiymCmMR4-DG0Rc7Q-WpWC6B-H1FVjFAnpAWuD48Gz6FOLYEyN4vthc9b6lQbw8MrLA_-K_xaS8B2UJJy0Mawnm8xlwivgqKq2gTe7koRRago3DuxgqxAPrnMLVR7I9nflLYuvx3bCajZk0sB_Vfx3V9NfFZQtK5WmKqtCQZ_KBuVnpiHkxoYYQ4wwEmp-yz6I6whh6TSG2P6LskkeNqqcP_5iJJia6CJW7qQp0z44MP-gJj7BowquNALImv8Wdo6zVTk3tesrj_iUM9Kq3_rSA_2aRiuIObgWWEUWdaHv1nC4yHgKTIWTVXCAdrRnBDOXGcJ-_rBsyedYKsMQoYpgzGhyC1gFd1tgI5FJpOYvvD_cnIc1hHiieF_a7DPMz3gAIuzZQpV__RkzT5banwbsu-wlBrD_LthWuRkjjciBqRbhUVWgCxeBB1ZLj7SBN2dxnujRMCSIvv-h8yB3GKBhy_uBjnkCPDK1_WZRkJr7ykG3ngtelEpYXfwwZGwHfWecS6aUiqlShuzjCsQVdSqQnZPhKhxi2c4MfTfyZrGm6iM_2MLw8SIho8SzvQV690ITn9MW78qsks9-N1Wc-B4sNHixw39WDRMfTh8d9hxU7xJl_GUxp9iwpuITRGWO9vTXT24ptO8cy0RZ6Ynmt4_fZJZlTNtPwJky7lTOT9Trd66AYoLbQbFhLREc0FdC6rW18_jCbjV7yqqRS520eCkg1T2JLAxk9q4VQ7oRcXj0ZUsTy9JfJ2HYXjqQ550o8vGn9rz_KQcKEQNPxL_aMwfx5fEvF-YjBZdQnKJ_H6a12tkoc06InDYicBvkrAt23nyNJ3_LSJ25J7A3Y5azO5nJJtl8FTl8SaWcnMNIQOr0U-ekKaeDA0I31RPx4pI9CNZCgCl28BTYLt5cN3iYGfTGZ360vxEdrifGIwCtuccJu_CaJbbsgKBByPJTGU1gnSPKBufKCyy-4cFmYjWqKn8Vo6V5duP_BQZQPHRs74Hid9XXfV7t22y0c1pWgNPrDugHAMRPtAHXbQrudxZ_mJ1O0jjW5ponlHqlY8WAYryBFSm6qddX3AGr0CUC9YdQSpH50jvJyQlCOdKpjIc8mQFmYseNt75GFaczwi2finnYXic5su0PeuvDI_2Pc-zTVIUOe8_UAxpQyPfz1aI2mwYq5Th4qkCrqjinN9Prdcxv0yzHxB61kYuRFK19wYjW-rgD4j2D95vFpaIK4_VV1H9LgduJqR2pCBRHKmXhDnlB3y35z4AiDgMiPqlxX_ifX8PwxlZ3PtcrJbLLLspfcc3H8kWwM5HO5FhKzql8TGTGkggT2B63XE2xwzptjeyCWHdvPoSuvfVi9FhVf7XYRBh-CofjfuCQxxJdiXI4nv0NU-FEt0uNsh69kBDf0klHX9pX_HRAIncmf88xdb4VeSfgXdQwctyZNkF2Ygno1B8wkYIMM4z4LU_l3V8qcg1zQgE4R8R82tQGFfqy-3tA-qet47VLwJT61GIvHLDFhiu5F6NAyi-jxBlBmqljQpcIrGa6RPX5fxRFKGOiVF2-wHMe1FaKg8sRs_Fnz1MhAVyCx-f1t9JCHiMLcsfdJwC28i_0Upp5zPuv9IZicJx5dM61K8KrxejzqqMq2Jn0DEznBYJPM5DPfxq6oxQfJQzgwOGH2MMVJoO4yMO7o210xsuDWR2UKaUpHbLEmV_t1CqGn-czNa1hrr9UfIsxnYdgMWaUZHLjB2FYjWJ5-w0aGienV59r8j-2yCM5JEXJ-1SYpQ7w4TW_a3NHXLyTXCs-Xi_NrlwhzEQySChJ-nedZKOZKvMqp-poZQgsa3MCj9PpUfwDHU6BADhbnsFtMMEPc1J_AUxTZ8rsau3PeBXTb5ocin6GMAJjKBSid2MVmwdAPenvgcH1M0NgItG4OkTxRMN7U1wP96ByrYtf_0resmiinIXf7v21IFzdVZ7wogOPNPZ3YzAaQ-hTsuiYsvl2mA5iiVaSziZVchEMG6ocd4AHxjBzea9h4SldMWp81L8Eh1q6wYknzAfyqEYTUO9KDM_7L7eFM5vEYCEreglv&cid=CAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=8290205236407341000&adk=4188270524&idt=65&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5253a9a7cc1fccb4cf0c1dd644b62861dd3da826124072f3dab864d8df831080

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119789&bpp=1&bdt=949&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19949
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57D8 0
20 B 44ms
42ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3653557350170&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57D8 0
20 B 44ms
42ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3653557350170&version=m202401290101&ct=76&x=1&cor=1953100035993765600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 57D8 94 KB
41 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BofZx-z-vmUY_xT70NG4i43OhYf1kRjVTyv6H-S4rinpv9aOXgBwDq4GNeoIcceJw1vzqiMpEfV4MAfoEHt-ekw8SMmU7h6xP30cOdr4Vh-aPOE-V9juLLuUsmdF3ZjgzfavuJBpDSxtP7wpyxTf357Sx2y0sMzO1z3iqtp4WSaYuUJc6mtLXQZV13t5mKGd53nk1sL7IEJKnSktAhNYkSq9O_lwXbS4N2R4fLBq1nmmQYfrk&dbm_d=AKAmf-AS2VEsn5GLKLGf5KJSBS61QDEcaYygrrDXQKb5epvBREgeqAdqsn2k_ullC34xBjKimCoi38BT-x3oqpXin5xHw3Z_o2tNhgBduqkynnTehm6WO2gj9skIEF6oZV8H-uplI_1hWaZsOOfSkvVt_-ikTsustkZXHg4OJ6g0Y3VpS1Knphj4Stj1qRwbMjP84bKmAxzdhxVKa6af0e-CfzMi9uyJzkjjPZPhYIHCcPt054Mtescubpwy4s5_VnzUbEg7yQBUf5hTDe1vIQBwruRYX2kG6xnR46bIGMhJdMvY_Ri5dKIzahwZrVMLOvByRZLJX-VlBNWv67SRRBmk1ocnmg43IWvQ8f7H76Sggdece17KW8-GIo12JSTmHOpRNq3qya7cUARP2WA2OWMjBvbKIVdJ2TR2qpNrDkZy_Pzim8GemSn3MNfn-5iFpZM9gezzryLnbfwh3MtTj1VYTz5kzHgOPc3NP_HSs999x9u6qNDEDiTiraYHnUpKHzNITKBYzB5cT4dQCU9IgRUn39O-U5mrEO2fQNmqnBlBv_-y891uLlCLdHFTzC0eqaB8F6GCsO6tLou7ft1csLPkNGShOG8Wpg2fqG4fsvsUJDIcR68mH0OafwtsK1GqSbF5MLSbW5v3-K7sI39q1UnLDMfDYAnK0XRkp5IPUatUnnt8n4HBBuJe7CqaQp2g_mlOO7bFIOZCNaHi_xqGp0Lnh8-TW6PS4EC1rmAlf2yiyQ-qdTXWzeqvXkUrSAgI5qQj1I9SAMTIh5ZRnntwIhaxPPO2JRo4qno75_efTOujhESXujPUCYoPHxidQD4lTkYPRT_cZ0xh0KmqmCVbZlxSKqrtuwR8C2zq2n8IAW9F7MEbdRDuaIQ6HqwNm_HNPkId2VaiiOiXSGylgoCB4mnWT8s6Bakkm5vaSMILX0OoD0TQV5GvLQyzQtgmlMpt_hrdaXytctw8N_2ch_aGaqiRSzK_kVnAFg0WbRc1_TRIJWve-gXGo8M8kqZedX3T-j7aYg8_71qnJc82ifgBUBoIqdJNeDWlp2qRmFineXL31dttY6BFTl76TpypbNdFjCd798wNKqZoBaICkExSRS4lBGMJlMLXDX9r8AYs6XkxWKGUDQJAHk80hg7P_arITbYL25VI4B3A-PvS2wiDkr9cudclJiU4kNMPMhjwKuyh706ITNl7ThsDaUm933VzU1XKysAJcY9V9YmFGe_SA0l4hRPPq4XSB6gJ5zFCExAjdi3RMPhVzh4aNHNXLBOVRRyFGV_an1cVTbO6_derPReUdjaXAPJn9G7uiW44MHaH7GlCnkwd-NvwTQhmwMVci31Yt5jv9V6K8dtoxBCwOx9CSl2T7p6f1EuaIeM1IamQTzhUAfZnfbvPg7BtW-BxnGHZoe5TvwLhGnWWG2b066LQURzr7KMjdCz-j5N6HyRd7J4AMCsMuxKwJtuUi3oqYAz3OPJcb6bWQJq30smPWmlRszg8oKgL0wC5drB-Nionz5rlU05QlYz4CJ2iE_EnMs__Ge19W6tc-sWa4oNoZoj3RTidN-q4ER2ZOmc8vavK-70UIIL-yfe7gqH8cDjK356VG0y0pQEmZ1oOLMZro5IzAr8DLLQN6CRj-rRHDqr80RUgvgPbGK4oj0Mk1dygqMhWuoYCeQjkUmnactPExBF5VR7QyWaBUVH7gB55dhZfsN-A1bueKMRfHPLVh5fxQrnbFqCgHg6cskxhGaroYlp4rVjWJLBpXFS0uBpYmIdUpa1m-OJUHFUn-Xn_Okn1pTjTkHKBvOri2bwrZyhitKeUT-FF1y2OiOZjOpACU_LYXPtUq7IOr3hFSOvuZjsfdGBIxVxjobqmgj-CCMHx04jjaJmLoDldiSTN-mPyD2v-CYT7JnEhUPi_r_BKOTcuUcbzzPd5GGLBw9E3zJu6I5wVAS_1GzFc9kK7UKDd_wUJOi4hxIbPr6A0OWEOAwKmFL-QYaj97O7d0V8IcpWpN8kD9nuXZuiawXbCpCWmJqdBLAOp8AEqTVA_0aHS05PzQoRC1UL4mH2JYJ7JFKFfTyLmlSRTLiaPJ4Nu0iB0anmQR4J3O12tExecbbx9I_pMThfHQBw9r6Az3WhprRblgzV6jxK5wlaDA7Dtkf9krW9wpnDDvr0Lt8M3aYFzh79y6KVfa0yOPLzrIPXEfP0Q_9IoDdRvggzWL-hGc5QmY6m5fTVAmQCwFXzECGauah23aEt1vOtLYQE5MzRLSf9MKGKr8dL8mzqRChN60bRX2wEDSA3Gx7Z2j8u7WotpAzMC7kzOL0MlHkqRl4Ket9eHK_oYUYuG13V587sNF8h7wxFiqsGKxTGRwJUsKMM9-aLerxa5k4fH6cWhF8xBcGyySjOXygdcOoNfQSzn0X3OMIBPHJW2ks6uJtZ26QFXqRBh5VXu9Gf7qTGHTp7y-zxUokwZbiXEE1bjrMlW0_DV9ayvGh5VI4pW2BtOLt7hVam3f4Pw6Fcb6trlSdIyg70OUyAAcCWn1FB3ck7X06wXlFFKDQ7-ZAhUcPgPIMuo5VAaDjPWloiGyOutipZRckWkmMtW4iS8_kaXRnYqNr9-t7zkcNs1l99yYgcb7kutJ2po1KyMd8hnYViUjvQ29Kpjy08TDgHPeloeqWvE78QTPTJBJbjhBKTeNY4a7hG5qiwsI84u7TQgd9m4QNAA8kieIWJ8ZjWx8Ruw2DAdAVBXr1WClQs0n2FJoO-j5k32l9G2RuwL9KzfuH8AxBQNN41nhN1suCSnAcREFaQRSVYr5Oj_I1MWMApf1QbNieInAuLv5gQVElM8JI-Qmmb_MyaNzasE4esaSfvOw82zk8yEYP-Q9vhU34ejB8KMvH0dlmyPx51HZTnQK1hVRL2jFjNQ4MyXkqEfpjQiGEoG_X-_bt0HSfL8V1PcSFr3gW2y7nky260ftx5SjeOJ3acD4hCpu-PHT-MWJ7-G221vJRDHnNPkthtOzdfb_40s9u35JXDzXaRfZIhp0jczd7ZmnkFCys8LdxffVtXh9Drgqq5OwvM5H0sDTUkcgYJuHhhx1ru6WYyzyFMJ5oSu2mbakVBajzNAI7P5B4IToiNtjJoQcIrymPBS856nBC1cIf8vrsmoYxNkXowNrw9YxNlAo2JQ5bgyST3SaeysK_OmsGHz7f0Pm3lS0xIN_yUS0NP07cWjMlWZlZpqooddGDQu_pI3NWmCqOrBnFtyevT1EdWu8ACDHJ_nnUU_JwNiet0qSZgvUd5RGAGLo86eOUgaLl0gzymAVTvp_WZ9M7UzhKgl3-kZlWRmwHQBcFnXIhpSpxs5N2e41OHtUAwQtIpdC9IKrV0fihsbk7s4Opb3yg49pziac1iB_hQyrqP_UrgzJMjz7Tvoa9PKESQ_LZcRnKJR99FbuIJ2e0defsNmh7T7izroQ6_bBuD4gb6vqOhyl7C2Mt9gIzMX641j8LEcX5l50a3vjV-pxk7nvDaBg6vWoi3VIwLYB7ncemuRb21-D6N4oJ9OT-1In_KdV84O2pmhiGPEWi_BK2x2Ds6rj2QTe1ZaRfrSsDqXZaIeTLVMp_xbP_5k9Sg8C4fXnWMSKNv34JtK_FthAGzPz_gmMHppO03iGOxjGf26TFNcPi0vlaqOUp3GfrZ7Av3BuFzXhf6kWaBVTbQwwdUS9E5sz1qXbdaGHoc5C1fgaoM73ef1UfSvPSQKda6R58UrD6hfsP9GtYhlAmnHGzrpu90DAH2LM6fJ5U2aYaUQ2fgXHgy79hSMRmM1cVZsdiXe8lM31q9SAK5RwJdTKSjWkEUIhqkUaVWL-A41zsx0nnJs7JM42HSA2h2oLAVLjI94uGQBOSxuxJGCnR0Zq97jch76j4J9VVQo2pgl1Rqz5jGkKeMl37K5mKG98WmbPwO1nelR4KlDUm2OZokMboyTJdo3oZUVTX47pBBrKNvf1xhQYdzfCiVULnyg-RS-IqPfflwtjtRgjeZRmXdg3S7ntl0p9aqOhpJoI_wWH7XvrH6QiMYWmXFzXf9rQfaMxCZyMOzBehiM7lzfI_LRM-nOZnGZX7UYDQCWWg0GCC2PGD9YvBPsvSyinkv0DRfE5Ojb&cid=CAQSTwAvHhf_sgu-PKiVcDxO10wUBldXXd5JKHIEj3LEPIFY-SMVssQwil0OOX7FID1bdWKlqMQQyMXBTRMTYUMixhTO1Vz3KuSMx8ZmwYYU2wgYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=1953100035993765600&adk=2923430906&idt=62&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

742e728bf1413ee9f18357cbf9fbf8b69993117553bf73d3bd9500289d807412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119581&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41642
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2961 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7982058699900&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2961 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7982058699900&version=m202401290101&ct=77&x=1&cor=3207431186591130600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2961 34 KB
19 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AX9jojSNDM3jVl-dYCuBUAvzZGyB45W653gTckxdScp7zKMVRI9UtC7s9x1lzTJeRs-m6KVQ2GyabyrMxzRnBoe3bm_itatInIXFLVTkNKCVxQjIixOPOVCqFlLYHAgVZqhq6F3IzL6cNfbgexLIU9rD1Tkc5K2j5YSRpMqO861TZ-laA&cry=1&dbm_d=AKAmf-BWsVdCx3AMEVAWKDxj91RBMDfFvNRkVygKRDN-xySR4BssaFKGyw-R_mECRHTPB9kKnEjhhK3NNKMfkm_MKCV8xxZPv8y3zBQ52iLWOm8eLOICOQB-R5IfxsehHhlhVKFEsj4avr9BSDinQ4qBsiGYI3ve4Kp-yNglho4aTzXTroKrkJDQL1bW3b3e8OGw7Y8ID5-ipWLV6LQDhsXphGngZ0-qjbtVw8LUWw_jDHY6lSmG6l3UjYW87odfmBVDr5Xn5DyYlFbnUowmCXMf20ESkSDyrWSzUa0EkJFhpnzabUxdJ3g8UHJok9992Y6LtWz9ZjUtCa7o8HutuUU9fpRwtSo7yIL6vBNkOouQ7nmNTRAt-1EgG81FrivXXs0JFzLvXqRc3Ru-BIehFE4cZC847OiPhjqRiPRXgdpVSsXJ1CiQR7iXFUpn9NvM8T94e3p8p2WmrpWacBzoD6bw39NoAdDLwIC4N_JWyMdD3b50JowgwV1UW86s7uAha-6bI7P5oTMcjbTKw1OCSviC0Ipqar56g6GxUMr3yqNDAFKrQUaq8ZuiGxjMKsCnAkJ4fgwv972xA8Hy51dwP3_LXp2w8i1U3qOTbvBiaQlphZ5W-afKvxgdFE5OXJHGimgx_BmW0he8-dauJw_46Pr9-557GG7M6pOrqKJdSA04WRaLyRxiSasW_7-3SL6LAHwIkeauuw9WlXWCif6rS_AO51DSEuNjUINzWGfgTk5ta33kw0dnRS5dBqvw9RNdG9DhPILD4wxjWvCldodERR_8rfMeZfCrPxZy8w-8CeF4VCTfgwGApzu21bpbZ-BWwNpLcB6hzOX2JxVp-1x3ffVv5CnfTU1S5ml-0RcFwBMxi4psT3RZEtNZJZEcgkIAMft9oAdclaTPajHRbqGkypOKUBUwMaCnzF-SUfaOYJGKIYZD2OwxWT73oEV8YDLXFhkHn11175VJH98Fd6_TfC1gZ-Gmj6rHXR8lC3J7uC-UAbZ0R7Njm2hRNOzoA6ltYON8tUdzmm-qU9PRSrccBt8P34w2VILNDaiYKnbVpGlhGE4zf_gWezz9DJm-uCJo_uoCPn__Bj9ie0uWEv_B8NA7yra-azkl0xYQHqmdqhgjBmtswePyLZuan0ICTsbjxvXLHaF-35WT9qfmlRbR-Ho_91V0MnZFGaX33PGW1-kocBYeYQ-pFkTP-nJ53OQlGtPKZO0MhAC-wOn2YgyKeJYfvhCEtgAJ_FDirD-CyxuT66Yt6DWY_3Xk5a3DqkkYU82jRYE3-aVvFUluj59atnxHwq-igQfNPd50ghzwpQLzeEnN4869fl6QGouQlyjoYCeEpoSMxjDh2JBYXg6lqHc0rbwRfxFqabvo4hubU4clgMpICZ3T2sdXvsk5Ej2idI7U4SERWM9pF-T-f_dv3tohjI4re_C-iJzKek00Ea2HRFYSDNIJm5qXJGKGwFjuPckwq0Lu0Tt3_-Y7xN-1hOohU2KELBTDFAquaWgZ2VsrrnFBDhgiahnmVLuf2784z3W3nJ2vkcwVUpOMScl6JQr_oKa8Gt6CIDxoVBAoWjyPvLzS3_yD4GS4BntukR3W4FkEwnfhWERvN04REuK7PoKnjDdmzgdnChYUu-cq9NuGTmctjBjUVt6lLIVtgqIhptD0L2VMjZjeneeOcSyB_FgOAndWYzAXEuIACmxuouxUfc77TSKJJ0OkKxbRWJnq2WLC4URyKAaZF-w5QbE_SndOeFUUljR5l8RConsiIxjodXMQuyYr3dqgvyaJAZoq66b43kH4nu4o9BVyT9mZ_uhFJkNdua1Ys53BmO50Sn5AQYQTdPbNJLtvGIlTwmKub1uv9MOj-_MdH9_5B9V0TAM1eEE_MofWd6GAUGLN5sG9HdXKgcOkSmgYJia_aaEgNYlWfpk5PdVXV7ouYpILVdV2DLhGbsf3Gm4ltukzhwjYtp3edH_GcO6VFswoez7Wx2qibHP7pDNCSnw1jLZJ71oyqViUYYvelRv2k481ueileyAW7FOmOSnSl4-MHsKTzuYgP67VaDjbXfvxFpgqp2QBGeINtAFIIfw-QWDEGCQxIIo-T7mC5faS024AUOSVpd_ZMYoPs8dvGC5F4wBrtvHmtVIte-1hb141VhsXrtiSeRivUsnvBJxqYWnhjttPb162Z6rDMqin2BTpE-cl2FH_jSS1U5AjnLY1QamRgKpXHTS1iTUtfU3jhG0MehOrUYVbgsOyQGyG2eaMmN0rwoSIvxRuF36VspQRvOelFsZvv2R5SeBLttC31ozfb0RKgFPLnlY7HXh3gw2Ex_ZG6-K0Zyfgrl0jMv_vBMTFotrWprEmXf0PRUeMI_10uYjQoNrAxnLjNxxZYX5xkj6TcjzPTLOI-eeVogkVBBwU0uSnrSL6p9XpDb3DQ1KQELsBsP5Imj72zmfLCCTkn2H2Ymp9dSyC4li6rdnuC1vILgJlm4j6uWgjqzOWAuegGji0M9QMIGKk1o2h7G0e89AhmxYAdt9gWGxFcmxiDW2LLdJi6PF35ybywf7Oyhzof6Eh5e20y_Qix_TcMpk42kxt47va10c74y1a65PMIwBFIwFnn1IEVfwLM1NRUKApZkLTixn8w0Exu5pm_wt4p2dC8pRHK_KeSQM0HOZbXFwvo8TT973tiy9gvGHSE0x8iQ80OsFarzrLsXIlrh7BF1SjH68YOCOCd4K1eQWkb5pXyrXS6OOc9OYnQKjGN_9HEHkTQ6Q7wrZJmKz3bpRj3u7kzxrlIB9DeSP6rTGLFMaHVopulrtaOL1U351WGal4Lo3l-JUANBNXK8pzx9g9cIAN5A0XNpPXh7yvNRQWoc3Bneftuq5va-TAEF8BvxWqlMDu5ggADsdcsAyBOx4n4m570HpInRACYf-u5CPjC-aIq_XrvloNVxP9tEaBy9tdExW7blV6R78rnIsOEq_wPH2wI7OjlYc0m97RpvpiJo1-gJ7oxJKY0eQXBzERRYaJxwNJUVUfFK8BbmComPVDgJrY777lIk83ROglvP8rG5EkZlrDjflb5f5WabCX1BSQKD3u53I3J2MSvAymJrtZdRAQK3nTGjAZ6ZTa_xhAlRa1z7LojhVClnir9q7b35O-z7gJyBBaPlt3QeNOMSNRh46E7KqzRV_bmccqCTAgxWLN8lBwHHHf20fGIAzsErMKpcscOUPaPriDaEu_Ck1OBVM2OVhPqp6OdhQ-gPcBVg0GO8CtOoIf2--9Hh4C8xV620tj3uE_Ab36zkywE0bmE2f0TntiDspzjGRL6gmgrnafcKkhmcW7XWZi-K-7ybFQ6wmT0P4yEjwlV3o3YZHWX7XAHYKzAV4eAZIKxG00RMtVSOs6pd9Y2arkN-NIXjtsAbdPVqt0xWBZtFHW49ZS7oOSohF7H-dK0g6DZUba_9RWkGZ6hG2lvMeufexHcQcYQkxODxctnWZvpnCIIxYZ1GNI7iF9BxZktaXW3LAHs8aJSa9suW3hBkCGcKB1NidCHDVCaJaCOdUErKInR36tCUYLA4DAfGS5VZqsq_40svUkOpwV30FQX2WlCY7rUbCoMqJ5VLsPkgDscdPOpXxnvFwzWi-nvmBPNIJ-hV6pwKMl6YFwRhLz9_q3ttluDPvLhztElYf9PbeMT6u-fCdHeCTVe90JNGkGsrmUzdbSfESxRLECE0p8fmg3DMDgijES15_3VNcw-8YrReJ9jx5zDeYacKHiMpGwhrWxZabvhoHcXQDK1hp1nrL-qSeR8MQJazvqKNI4ZVn77Y2oHYOSlIKcNiBaYxiKvwhXn6iduaHJ74WqyWYIy20jgK5uZp1eOehS6MOYCLdsrmfSwMiXWJyNfkMFjrgE0lCK3R7FNWT3h5oZB0RSQ_YOfihJ4T0W-1VXxi4IVMsWgV-Uy_qOFerF9PXLnbqh5pGz9bvVtAL3uWCsm6v7SieHLHRqZL6bRkuNJ9xuPbuwVHV6VTteKKcfSM_wWZ3l4Xoa_JXsIYey96BFJ1tcyNqTOAzX5lo6nGuunjKs1yZFylBdaKA8g-S87tng3wXTi9eECNsW3RmvSpKsoE8nwuiuNG1y-yMc0WzkQRMNf04K0hoqqxO8sA1JyxYtrXO1AvxmRzFUaFqHozbXxzLmuG7US3ZN_IwVG_3G1iF1HxJ80Ds3963N0el04BRf4EC5Q2qy2wKS_CcyyObr7Kp_NIZIc78&cid=CAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=3207431186591130600&adk=3690638928&idt=85&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9f8e727380f9e36bf69e533dac854ad4757aa517195c2861f53900b7c38e7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19886
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B44 0
20 B 46ms
43ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1604269243120&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B44 0
20 B 45ms
44ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1604269243120&version=m202401290101&ct=76&x=1&cor=8376042128687570000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7B44 107 KB
41 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bf6ZOCKK9Q1emuRJYTw8v4ymN5UJ2BrbdckcAxmFTOMMinjslibA8RtSg1Fsu1hKY9shUcYkBg_jhBP_4o0qsUOiH1C3yZj8qtd_ETDSfnr41UJmx4ZhX5L8qscx4fCmGoDp4WxHA2YKa4_An4TgAwwOTc-gAQuQ22kGT_SWKKp3eymHk&dbm_d=AKAmf-AvAEjAZCajk9zOckMdLrB_Ebv7VfpXO6v0DMl19BBoKKUwqRteFb-lT7qsM3pY-llrRp06uqwPjuXT4pG9fRFpVjOUdTJ7SRH0Js7v8nZIBGYzfHjBFUC0OsL5oicAqb3Uf97iMb8TOi9b4WtcH_knLR3giJTZQwE5gDkfDo36Nf0xa2MntcJCdLir_E4BKMQ9jEd4KhuZjilaJI6CmekoLfkrOHBXySLFf8gF8YHzDSYVPSzhxSO_Y-BUtX9W_OPWeTe0dGB5AgxTRKrkmNHgpK0cq06t9RRBP4Go01XJqj__KBRuHCpR-xyfMdDg9BqAdR8Glj8Z7Dv3iAI7dhSbVtCYw2cwiCnqifoJReWVpVO9qXd6fWeMV0_KQTMMdFvCDW1D_fvE4tMLwzmmpCmDa35Wx3lLqsZy2V7CKkZqESOOKnKHmktjM60Ax68JGwcwLmNNsDrWueYjX1RNc9c1Db9aVACW5JDEbk6EsnoPZ-ujAmjrh3bCJBuOPHJL4Wtf9iJLzsBTD_PzI8tAR4-iBh2ed1xhWNmkFpxuL3QdLr2FVJ-4Zi34269uh-yfc3j3KoSoC7LGcTn1BTFS5efJ2TvKkNYqLWlRKai4tTkiejJMv6rrI9pQwjr3CVs-T1qaqb0QZM7SSxz1CcWCuJ659PNAzBcZKDdK92qT_H4wDcJZ3icfBpYmdgXbpXJvWn2EHazv4iydqIkzNKLX1npGeCr-yYHSwdXeE2olWDMU7hv5nJu7q6HsNzrZB1NwnI4mJFzqPit9l9LWm1L0SQ4yBvI7PdvhK0Gh8d5IzQmmdq0pjI63RtCx-Otyom_iLvSW9AbogVbLcDvIJDBCe4IttAs65wiMgBM045KGPkFjWUJa5jY0DehvbgdScybPxn5vnWn7YUduY_F138hF5o9feEHzoFnMMJePB9V5DMepj3CaLk4kcnyoq17iigw-pTggei7Co2F5SYz_fD91Txmg70P5G19RLOHWrToBfOIDa2wwUmJeqZoLVNQy65ntoBGeCL5SmhHUCFURr1fROoAQZSDszlZSjvq6xlqkaS0fG1vRUfkT-drPoo1fArX5oiMbbBS8W68hIWZZCNvtEdWaWFPJ9zdK62AYzBLjpB3JjbH7r9bo4gl7W6myCYCooCPeIfRJlx5za6OLcCxeDTVXLmllv5GS3guW98LKbuXtkEDZcvhBMrjvt_TCrOcLcS3pnElEbm66Sp-gxZesXc0nVN51bNEn0oZ7wmKotHdoNkXbt-CBHLCpnXgfSvlp4cUmbNqVMABVUkQA3eX8Y4LDRDZyYP1fP1MSP_xnq6YopfjlMOxW1C9_JdTkK1DymxptiT0RZL362aKTY5YjkdlXWae2mIiEoQoFLV20L5DsFf62mJYo4wQpEGu1bu2Xn35401kTsCmM6erhBO4J5fmAziRU2YImYuEFbI66QR0BRPGEbMsWXb99FJ7WDpBtUgnrHRtrNSe9TZpBxz7O7ZZH3oWRQ5ym4u0z_Zl3Bm5-zdXRokp1BP6SeylDEdqbheTheUr3DMk8Y7hiNg2chpMZkOnjO1Cxk-1Gzg76Eohs4qf_guzfpUci4z_gl_OvFjpPVV4rqx7pDnOIOHhdrFa-VeC-QC0SAMGbju5eHez7Vr9mSYNSqp1QBRywcQdMiYEZOuJXxH8cX8SX_ZdJwQlZL_cMJSqmcfdmUi0GcWG0U5KDcu9XJgl9q0sjgLI83c7HXO30PeTSnNTY0CXcDoJUUazGkIVKkZNHrMVh-8zZWqMmcnKKkoI8SqYPccgFr2YDtngpaHmfjsnHJCQO7hqu1IOIIguOlv21CDBsfDcdU4fFshH4936vbQAtj3brEntm7k6ZaX7N_mfpYWwvvSvIVHHV1yKGBwfBWJ5tXu1xLdHeLoAN71H9F_SnzSBIdr3pN2qCQu59nnXQYX5uVZIJsxkNKwkSZi27qEMpxY1nSoAsgG_LPMPcXhQsozzq62_BAnyvZiyHcD_uHMXG7OLl1OvM3YyyQHoCZ0WeL_nmk6_i5vXlrXf_xi2F3H11pxStTLkURbsLRd40uO0ZSA1klu9SLotW4-2efO-yPKoZRC9x3VDkUccXc905iMGy3UsWm9FjGm6c8wrEdsYeWPLBzcYAJb7eqb2eP4nn5SuylEn0F_8oss4aOv6dMF2832gzITvv3hMo_SJL2gLdnBkq1bJ1OQjUNAeTmwCayldJxzweGAtcb4VSauwdM_YiLLphHPlFLYUbwaaQZbN5_7g51y2kYMqSin6L8_H_Iv6Pl9Dt6e_Vj31TfCDGbT_810ycfc8AFKyMdAhdFmkk4I85oAoyy-ZEZz0wotTreo0FNs3llkL4eEnXoPQQV9T4v_wLbnfXFWlK00n4I50SfdqNTOYh9PkeYvkkCOsSmu-N9bY2fAMoAlrsTqN152I8JbS7SBips4-f4rgC0-6aKHscRIAUxBaYn1KRXrk3S-QaiCd3qvx1OuX1iefz4G6-JK-rAd4rJYD8K1gy5Xw3s0X6D2dXO5EDxJT-wOU52I8NuMm8TlVLZDz6G16rQjw0GSvMySqgqkT0NztTJlBPbzIT_ndF4Vu7c01Ko3CXf49mE_v385ob-Zc_I087cgbjXomtvLJPsw5Ql012gZQ4wzFvcyovtB-4a--wZIaU7Qyh9ZJUOt0A6vUe3yR5J_rQbyIGLG812VvatW9FhRLx1V5kr60wokuKc8gZTct8GJacvOuUApQAXdsDLbuvADRiP0eTLZU_-k_9sLMnQKUFI8MXqcNlcXieGpinJaZqnqBZ4Qq-hDOywvqmel4REwn_CFeC1lKzPkK9UqcQnLVk-1E3p5odkrZuPmBkXj-yO9wtZCH6gvBwv3N80EO8lH7WwPTU5Fvmoh2DVLsf0iovps_cNhXDugxw7LCn4u4_5mvbLBm6QpePstlqbpCtpypKWq4gzKcpRgDFGrNH02SvKK7R4_1I3vPfa4pZbk7Eb2P2Sgku1YMYOQC53Tc5oA35ll0CfxKQEF-48aDS8IBHh-jqnOj0TrMNRBFNb-JZzRMuI63rb8NvtnFqzfirz-yPc29PNGfVhCXVr6Ljf4vzRXyePj4Yx6wa9d70tEknso4fNDc-5U80R6aCX3SCQrn9SfXrr9wg0i0eTFA4O9Wvc2FbHt2KOYNyuexaX8nxpr92CYaWiAyrqw8_KaJVeP8lY5XIhsUOxiGvaghV8lLznj1MZdc07ZGutFexlOavDMHEygzBQcn-DLao1HSzanMN5SC9el7hhhnLG4VvWjosR7cHfO1kf17B1aeEhnVGS-N3_IGae9leCscPOxjr0YwXxllNrcEwBW76BGv4nsFtzpzbflTMFPf3OREHeMSvxSETFu-MdFo14aSOEbeY51FpGJuNs49mYH-OGevGxSqxW6pKK4Wnw8E4Zhr3nrJeFZTf5keiYjdEdDiqTOkCxIP-tzUwrQy8riZPZD4JjMLDyxYSJGP5HGMC57zpKUTooN1AUea_hpvP0fEzzrUvRzLNgtTSeflOIVOcN4nsPfvGfG2QHK_IUYCoignWECgqVbY5UfkmJhwV7Zg9YxpHKHqs_aFerjJhAETDHetCOYOuuan2iQdulGD-9vc26_eb8_Xx_vQD4Gx1-Q_gDj3Lc5ix6qFAOgL65_PvE5ZSOc_f3U6jFa1WpuibUA5onje8ke4QqyexgYfIAJVkPVWOwWgxBLBst1V14d6KsJDruYUWHP3o-4zhBszbP6heArYaHr51cHhF6_gmoG-aNoKuhBq9yL1Z7VqLLOnQOdo2El8f36ZyLi8pL4jvBMhmjDLKm5sTkuaKTxxpdTCxpXccTd1ZUluTe0KQLie8QaPyb94OSFV0mD1xNQ0IFKvq0wyKFefYBr5FwyZcLLay4T-gQ9qfj-Pf6D7nM0fZP2BnrG4tSy4SPB7F3rUFo9FO-ncdoyN8qcLaun4fvIzeyzxnjzYrURhgkmYgrcJjsqBlWVk_BfpuIa19fufAocyZPK662eVxoxI-lzhXbvGt0jElohLj-cFZ3mnDnMQMKYv7qcz-P81if2AVjA&cid=CAQSTwAvHhf_MADGL80BEuS5A87_8Dx7lr_ed-JgwKVMmSCV1qf2wHo5Yfi0gk422n7oUUbMZ_ThNwUnEXGe3fWVR7ubBEaLKbz72azsMSy-J-UYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=8376042128687570000&adk=1215661107&idt=63&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd450eb4fa74dc96dd0561e0af2b0fc678a2aaf3c7e3179ac44611a0248a905b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42403
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 1418 11 KB
4 KB 77ms
12ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708101119893669&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXvui_43PZeXFNuLs7OsPyMmUkA-m5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0Owk9oLq8YXQmdv_meE7aH8DFq0dg-mx5Mt0gwI4ew-cjT733sP9yxftZINe3XS4wgqWosYCQ-aAWL28BBeLyR2b05uz31uRPuswEK5cYxIwVT8v1Rl9owzACJGSVZlSFW5cFe4BkFL4MN3MnFSkSqFJBCWGkEjcXwYc6R7HtZRoSmRWbBWFqp8QsdC7tBhEY5ga0N4TBRFXtNfMouMe9I_NAZHKvp57NVLGwuDdLDURfD--S1NNumm_D0XESMrNMgqnk595-fQ4B5NQVEim4h_MRAoCOI2mVsPZFA5bKt0vhHEgOpn85pkovs1BZdnuVHfAXWQH43jvxsFyyjTor1xwAkS8bC7mn9XzdqpmwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljXqO_DpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB%26sig%3DAOD64_0VoNECw7f9nS9M5vGzWf0YFtFWww%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C-wWTMDDWQGakLHEMzpN0tzzDuNxn1N1khVIltq8eaq1cDBvOcZMngXyb631m8eyDfJ15Gr3nFlvbnJpBon82Pn7Z2B-PcagIlsBuwJJrIW7paPiDzSjtXovFkkHLFi4ErTxlbHrWGpt4trqRNRTCW9btO3piQ022uJMB3wy2bAjV1Aes%26cry%3D1%26dbm_d%3DAKAmf-AO-b2F88hN9BU3WprayDHvbp33UeGfwKc1fmj9SyLDeHB1Eg79WP3OoVCF8PN5QYJDKKNw5j_8Cyc4ZvJkv-TGdvOrjYs2SMkJCTXX30WiT49BdSk1k1ZT0Dj8anP1drDwUz15JGCh8L1lM1APUCw4Whs6Tg5ErqwAEvYN7rrNOLpaET-LUJl2D6ixe56SzxV5KONXOrK7l9knGe1t6bb4dSpsIxFsQeE3YTKlQerIAEJlpL01kwUsRrO5I8SZjt3ew-Q8NKvWYpRzNpIQ6_zUgCtN8KN3JhxiQgTTSpiThuL44HhGqOInmN-2nBZCAxfwN6INPextX5ribUj6b9faKkOs10JoVkIbuAvFSeuMIKuJrSFS2Y-fya63ecX3hw9uzLg3eX9ZqYjynM1XIMPcIR0eTwCmHZklYMz8vgxNs_14bjH5Dhvv7SeSJ50XKd4fiZi3Owz-UDvJs2LbhFblZW6L4GarQD2zr5m6TKJsBkTz70fQPSFnleu-r9wtx69zyXsr4qCggS9X89zYHof7N6sZOle1_5RCng6bolR6RB74kDA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 604ae98db556a494e33fcfb9b06f3ae319dd7436eadf1c8a5d212a99b7dd7c9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4204
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 css
fonts.googleapis.com/ Frame 0226 14 KB
1 KB 37ms
36ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 15:00:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 0226 2 KB
822 B 32ms
27ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 05:19:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 05:19:37 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 0226 23 KB
9 KB 39ms
33ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d196aab20ec653c7f7dfc1e03cc9e2e3dd7f36ab63d756f7c436c93b26c1007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8991
x-xss-protection: 0
server: cafe
etag: 11525033739721728465
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:21 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E0BC 143 B
166 B 32ms
27ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3206
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 15:38:34 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 0226 3 KB
1 KB 43ms
37ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 13:57:20 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/ Frame 0226 20 KB
8 KB 37ms
32ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240214/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

245cec0922828c15b3709eb696bb5a565f2f911f71e242024570698701c9540c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:21:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 611
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 16176141338659805634
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:21:49 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 0226 204 KB
61 KB 18ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

841f365e0540df77f892242a962098480625d80f10e380bfb93329a027978632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 447
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62824
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 16 Feb 2024 17:24:33 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame 0226 36 KB
15 KB 14ms
8ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 00:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229675
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Tue, 13 Feb 2024 01:25:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 14 May 2024 00:44:05 GMT

GET
DATA 200
OK truncated
/ Frame F05C 205 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d947c3a84d4a2e00c9264d2c58c4c2e2475481ecd98e51317d7f9f895d6bad85

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D536 0
20 B 53ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7164366584497&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D536 0
20 B 54ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7164366584497&version=m202401290101&ct=76&x=1&cor=18355799182143474000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D536 107 KB
41 KB 60ms
51ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjqEyhT5mRwz0T7-pyNDVuhTlClhvf3lSvYjbhdq-GRjCY5_6Z-_Pam09L3FiCUhJpwG5KitFY4NP_aKqXi97sjmPFNfErw6LgaFBsOxK9F_K-oMPcd_6tzOsLo8zsUxWwdtbSkYphfUWs8DDgkv1lxTvqPCsKBEEhdSRTyYlYKNqz2iQ&dbm_d=AKAmf-BYeYlXCP2r-KdvNkTtrHO_M8sbobvxQ2GzgC70tti_-4zlTgPxMpv77Ejo4ITTL4ybBoHcqu8gc5VI6d8r3dkgvxY6Mog2j2On01H2EC9W2FP0Ev2sp6kcp5lu28t8DdcFL18GT-XaU3kYu6JcJocguFWsq1IAf2q5TZ3x57EyqCQsYnc1jvM2iaHx5NrcSjDKGzFkne8AyfS84nM7fTWO7DDUxEKYofiH-qHgjdsxulXPQguOzzTWqPx6JDB1Uk3KCBm0aoBAbAxk3lvF_p98dJv1VrHWEZZ9f23ITF_N4-m68pWnCEKWooCMuWBChL3bhCvnP_0bAuvMsLOJonu3UckjEqONLfHHAv80PFjwMpVHfrX0eGXwyVDXrYbF3jrX-PDApcNXbeIhnRmPDmaDs8-lJ2MbHWK6fCd-XHiW4F0UVGbfE0HzD1G9NOGOv5u8vlwglnKO6hT6p5Vm-MF3CnKgYZFGK0N7hZxrC4hfpqw6cE78UVHoBYRdqR0_HQENFBAESJTx1tnTcwzWEJ-fS7p_oVVIEYnOrKN5hjHJfB3bIYXnoCfMl1mIthNahtKysQDAEig4Lt9ntkRMecm6rJEv6ySYWtWwTx9wt7hz31DeIDVaviAxb32-LXlEMrJwpN_SJiO3hPAl_0tHwF9mn6Dmfv_jivLf01Yv7Qo8SIHVu6g7a_xhzFC1qtE2ZIun0XT7I8JtFikSzGsxDNla1n2iOx7EuHCKEBCSsPjSiRR31a36tNY2JYSutZ3ErZqqxHITfcIV8bzuI1Dk8006cz0AgTK1Dp4Wo1ktm8ueqqjfvqjT29oMzW2b3sckGaWFojZDt5dsRLNCXBKaltp-VIjBqnGN9m6nwfKrTUCoAcIJMFfTsj0-P591j2lAeVIXyKKPbmFpT7laqu5a7PbOR_oCgUG3AnYd0Ta4T9cGHZCcpGbJwWDDFr-5qYbMWE-kI1-WfdKj32xEeYNPKDkm5I_BUQ89AD6ojyCGIIkEwDYESBNv_If2YtXAiaD48zNheKWFjTJT9rnFSCNYLLRFm5TaqNIW8ACcJz7uYnD-4wkfa5Qgwu5B-P0o_3DWfirZAUwlbGEj3D2NxyEtW03melXB9XqXQYyb59LvwNOXN4xMBYQZvEz-4ZfaYxKKNFnEaHTv3PUWGYit0LPtUZMSCNPQfpmd3lCUMfvsLXMtjh0JSdTBORnFuXaQDFoKaIrhxJtw64q4MtN5kPgD4BdgWgOHpB_6U8ckR_HxWwibt0AB8-odBetGhCWAFWYc1JBM4iBvYQ3Mvjss5Ll3SBiOuNjtcyAggtU8gVfZ6YMDeqiBCV0SghRWwV6Rd5a6hvoksH5uZF7g27jX0AM3Jx0APWoiYxSsm5fHsgfynEPnikNhfmtHXvk_clKYLVLvMi_LtqF3ijsP_nJY1MWxLkWVsaR0_Xtqgpq31jMsC3dMoWrbBi2vQBLoPjUHJsqgvExdWOy5BQ0WM8vWFo-i26F62PM8HeMn3eHb5dFDTQjTExDTQofdBldQZndUFtWkFu8nviTLdORx4vxT2bI45XfwwnLNXRtgG6cqd52t9wCP6IzFzYfDBtZiyrhuT3fhI0GEYk41wkhCUnhhY_DcrkumyvWNOcf4jebO-NFo7JgGr46vCr4W_CsXX7nVsUeq3gtc0gO1S2Is65TnhKfDUALW_AJkYp-JNiWkos__Jz6mfyC6w-aGIdJYVG1IB2ptL4jj7sQym0mKfc0LZ7Z6wkLvl6u_7XUK7rMa6axL-OWAYH0eQRJz5OKHDfEROd1GbwCCJArdIq9wYFewxTKXkQBa5DV4CTu9Tt1s3GN6mssjGmEQo_FYM1kM6gHZgK5DCGvyehe0AhL2AE8YjfvdVzpjN7KJYj66z-c1qjErsltlV4poGDzANcjFQUpMhjs3gKf2T725S5C6_2RxMEeB1fY7oQZB1CwE6zSp3EHTg4OxFD7dBsKeZURf3PlwDUGqyCSwNn2weAe7WzrTlEdyJJZuduGKn-3q_MOMsLaCD1jC0KHKYF8vrlw1PwMD-Ty9ixzChgXrOpW88mmuYXzKNxIKFwErx2bxorcTzOe99h05FaH0_DqzZJVy_9VjRJwpUpwWsuEL0qBq1v4MQa5lmxkSkPeu9teHJXwBstyJJ98venWP2bjsMMYP2fk_5KTRX-BNGhhgYjCW431VAOGDBcs5oT3GEVU538cukL1FFOW1UP3Y24ToWWRCjj90WssGVb48pSeEC_WIq_PgrKjzNILDl83RenX80ViysDyNLz3Tbc3_GQaMxNgHfvbMmOMuHOXpvFvzvMMs1nh_AnlpAQw3LvRmRn-bAlmNJVsbfbS8hiX-_HLMemA64A6AlnUkWKtzhrPgK8L3K9Cqnp6vp85Fktoj8kL_ukHQRkG0cdzqYRUIR55IXv7RUizfOgvbtlKhJbQvMPtL1F2_7BKRIxBz97ZQkmAF7qIojbWSdjOpQPp0p0ftTgLE-aqCV6S2400r-xcU52ITOBtdWXVbRWHqoPcN3MSHm3jFDdwsoWQeubkZqjzLpdbmc135wfMGzky5s0gF4Mhaq3XJwekfXGrLIlHgUrwrPD4_fXTJA6GbA8M7zCt2tXq6yWLdXA2WfMzbASJjulqyViDgooC06W6kL19gwMhblspyTNrrXsl8_z25XKWyj7dVnlArjiJuuwJfMa09xCRNWO6eG-9iydY2VJgOmAm0ytDNGl4phDiD-T4yXFl0vZn_tAO_iImXs68wJwKl0nyVl0snk4N8UVJt6fHin_dlPiZuKPP_25mfYng0wmQ6jwDuM8IKlLrW3lVvpKUR5XVfP9MimH3zQwcnErGq-tYmHH598diHs_ZuCSKjlaLepiz7LAVeT8YtXtoPHkFUefsKBJq0gEuQT8JqgAoRSWzYqv5c7nZBlFSAvsH_vpOdVziP7N289Sb5ZOE6ARQC6s20PqlXDALkt617gmkvAKfZYhLHahqb1OW1j1x87E9jxNGcOo7K5xekS3ReEeggGecAiT4zvtXN62BbXW8tQwhWeF9axD_l33oWs4nccefSXXnJfdTS1XlacGUOQndmTKyKkaGoNUKJgghGYz6ZARlcF8e-YAF0pshUPSp6tIuqPPZzNlUEv7kgQu-aI3sVys1lbVSfhHdpJXo3kOoZoGENW7S2e_EGdfkzGG0e3xVKQVpWxhZMj9ydPKZMnIXhVONTiRxFsJ-BABvmkcwiH1DdW_gZwDS1ZaZsGH1CiNLau4clNeylQ-xqJJtHdTaaiwefGC3iaiW7g9SceiC17TJ8MpGSb22-kyKz8BFGFzIk-I7S0mWZ4f8gdwW-HoW98aaJwxG3t70YbqC1NfE9muu4oFAlTJcI6KhqkRkWu6GNEtiFcqG3lZBbZRfCz0RrVWvyV1wVi5Jm87i7abJDgvyFQx_fcmpJl4aJZLQlUTCuaP40lOh8fVvVnZc5NijXl7XHcs0_Odxm5v8uJWymmnEgDqLhSBDUErF1u7u7iJdcJUD48c9Zsbv9ZcH4P7bS7B3PZIucs-iplyB2T2BECnBT0f_FobugNPgh4mVsGzOaLRp9Pn2WhKZvJX2YR4fmuFn29ingUZWRcC4VbBlj8EP5QI4LAcfut3sQbbZWnqGOr0zUPc23U_ndw35h5UEGCjbzaTjK9ArAe1tmDl3_Uq0nHdzOscMZJB_TNVKxSYKMV5uQ_mP3JkRsFcSNmimqZpCpYX42yK8gCvwlQP7KPSinXbkXa2PInZLnl26caCENaoAPXCW6xzin3VyOIltRUrqDCp0ilBnYaBzqIyH4tMkf5_46FO-dd4cvMeitDNyXrdDFbAkr5EmtiRuhecH0kDqHUJLEtnKlvJrV6PQnRbcuRemOHV1jbJo85V1U2EnGsTjma_2zkLaOfeidrDmLU2HClI7dQqCAdHuEB7ki53HXtVmdn3oQ9S7OINdmg6gH-PZEHkNroGbyR8qddMMk8LEtOwVLSHIaYuHUyMN8SLhv0uWVMT_s8k41Le693_aLkrZX29S-gBmyi4GnlbWk30PZ-8BR-tl2pwXBQ4vwIQ&cid=CAQSTwAvHhf_MADGL80BEuS5A87_8Dx7lr_ed-JgwKVMmSCV1qf2wHo5Yfi0gk422n7oUUbMZ_ThNwUnEXGe3fWVR7ubBEaLKbz72azsMSy-J-UYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=18355799182143474000&adk=3430571819&idt=82&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb226a5ed8ca6aaa226c8d2ab33db7c37197edb7b46425ad6969b6d75f50a4e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42403
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame FFDE 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFA6 0
20 B 38ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2679889179326&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFA6 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2679889179326&version=m202401290101&ct=77&x=1&cor=768214845007660000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DFA6 35 KB
20 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A9Vmzb40WoJqhUH-3wRdVV3yeG3JgTRf7T0EhGiLXGe-IU3bQair-8OAAjhuTCqs9-mG9e5c-3kKneHhQcP16yd34UjlVJw0Orw-Qt-NkEoNd1TG4IHrTbsvwQ_CsfYMwKMEJbJxbpsZTxGp_MC0hFQgCb8MnVGHfJWb5z5AFHmBQQ6Us&cry=1&dbm_d=AKAmf-BH6v24h87JME1avfSElptV3F3zJJQ9oX7tgvGeR3uvHgSkO_FBVT40LnP9IGCZKoPYeax3j3CEI2baQe9YkOb_2lxY3OHmyzrwQ3tidok-hSDgDm8cpPS2ISUUReOAjC9OWq6lMUGfNnzAEJxToCXCkaOM0Fr1b_qI4J_Cevjfg_-I5GL6YzAf1D57D97QD8W-FDOdZcasxXwMyz0XIr9KWCQb-Dn57dp7TGPEMzq4MqW1paEaABQ9JvKdIn4WHohIhYI88lLKwDKuJ1wvDGYPeO-FL7575YVar6j7j8R2OEYmALM2kR-62mZkVbc-2cqEH8xi0PMjDp5QLiwgozTNIIDkPHzjqzmryOFVtdCZIWOr5FeI728NXK7Kw68sGQCGOFEeSiLkVswgORjSyz7iBfRzXJhb9vFkS7ySIoUiWUWIn2_PLFz3Icto4a4rnrl4kRZz9z2OrBHlsqGeqJs_IahMQUxVvlTykUOK-etdaZVD_KVbPbNWZV5WejvUh5yDBrZJ1yYUBcbh_LfcKFrGyYAm2ExQ03Q75PUSaprHsgioq1ef6_iH29W7JWv9ngdwgy3P-pqob2wHpK4NzmaROe63Nw5I9gqiS-SpAAIuv6A1E9Pp_gvqNAWwm94-k_eY8lfusq542gOflKeDEIt2M8azTJT8wYQfsJLj8Ug2gftUsyg-G493iPX8XgZnFrWDm22SYjuC34Oo73E7Bfxgt_Z-d2UyppInSjHn2WNoHfUPIC_AxkFm7KbfvpDXNhMRlkQU28jI1yBKHkufiVoS8POriBw2MSfyZfRkg9Z4GlvahG_IIp_Xyh1d3jP0S3IUo7lxYeqZVg4wPV3HvlBWzrlP9Bm_R4R37bGeOzPTZ7aifV8K-sZTvIBO7P6oorsmETvUJ_5UaAJpHbpb9d2NSVHML7U5tTgMQ3N_oy3oAJhkPo_xKPD6JdsWypqlaEaoVYwjdWXZt6HUOoOxJhtjqIu05trr2qF4F5htkev8ZM7hvY26s41Ej4zMuZlQi6sp2131xv5TmdWzIpdnbqaAOYuBdQT_daUE8Th1RKeJ-AUlI1oQUniFsbC6Nb8rrYykZvgF9jV026TzvU_29tXBLxBc065fNsiAV7zlmFE-BESn82Np3baD6NQRbT8SG-X6DoFKraW77sPlzEHzQCfhOtTWHmbu1vXPCTqh2fXfSbUiYwOxuzDsQmHEKKXFBlvp3pcPfgM28Gl25R2JeP_zeF9NFg3nknbb5Ay6GaQj6rXve_P9Y5TnUKab-r4AHdqHtyW5T0OKf-P0HddZV7JmKGkNqARsGrSud0ZD9pxGnCDM91gJESrJxDd8uPuxZS3-toWlhG_UtE_sRQNvHAo-M6Z7q5TnbUFEtuNOc3keObZu3BdLvI-o2EpzDWkp7D1qSwkOWptaeXcAWeiktO_eGYkqb0MCj51BqBRky1VhCYvSo4STkmaRhyMEVjI2OCCpftpHz6Tf9KyM55OY3c4MY0xApm9pwNRM96Im83tkYzn1aJLOi7Jq4u98zpZ_zi1PkukJXMXuSnObiFOpmH7fGntU5GqlfYF7vWgo1O_BjEh7fdG-nghoNjLdcFQBOjps-nUA2v1wDXZ5ACYtCOApqL_F0Y_Xb-vJwt6ywlTTst5D_X8Xtqx6sMUe1ZAwBy012R_RetYCSzfSh0nOeSrakYTbZss0xibBETat8GnRbDJADBM0aUlVZCHMo-vlXN2bm7KbWGwVSe2eSC4WMaUEu0mVIWLadvMwgpOPf-0XDjyzxLGP5p2mhihUb_3PN4B-leLn-rzQl6R1EPCPSMNkjyjizeYfQDdfWOufV9iTzLPl5QeerS8rI3wkiJBO4kzIqlZzxYbVDXQA66shSSJb_gSJ83Z-Ht3UyZPlJk_Bsyuhg6WcyjeXH2uTGA9KgJSji6M8vHxH8eHic6uSKGVm7JijP6fLED1qBpT0QtxYjfchKKAjZHSIyDp97AV21bIMjisXqq0yCjiDzZjGlUu9HZiwWLeixNIFJeFTFpsjV1B77Ik9x6D_96JZpJrxTppiYbttYA6D0n8QN2yuSeIvdh7Ya-rbMVt4rA3OkVNj910b1oXTZEyFNx61V1jHbKYgT_cV6Dk-16qT3ti2PxPPd5xJ-l5Xv_a6h1E-HQPjI8k8L1w_QKcn15GRFNcAUdRLA7JiYPLbJvLyOolyyrobk_haSOG8eTI_SvQ-XzNBZHNiazpeEx6hNC1Z3wNk-lvtDErvLolnylzvH6ciWkW7cRJB71EerRKZV4Bki5AZlL96cPryK4C_9ngKneUc5v5Qcu9SaVIugl_I149-tcIzFWwvqaUNOxUnGRhsypFhRHrc0tz3ggmZoC3agp5V6GJq-SoWKNT8Dre-c4hQ30D7QmlCCW3GSbvoGwgtc9wYk7gqkMxy17uTFJRW45s2_o3KweBTa8Yb-ZLd9ISuER8XTyb5mgFLMFfyBkLHOBsyjxffA5LmLzlpY2vvQxmkhxbFkXDzkmpT-8VrsZWdJfEMviHgz5mn8cqo7VznGpzlOV9fasggAjRAIqaI9L74bYyTHYsPejgpm8ixcMUgpGDnk3spibiQuhTIMRqT41zoqWiXTmjiwY9fTo-5lz0RIugmiTtRIkeY94SClORTSC5xdaxwiOI0p1PieGQdhywrPinbG-u7hn5x4vMX3127fU75szljoMusTdeH_5h0bYHjM3C9ha2lGIn-CsOj0tpqhiuDrC4HXxwESQPkSE1jWoB5DFP-BvjJd0wodeDnt4j3zDRlw8rPT1zhWMz8z-rGsyq9lsmhFgpY0_CNXfuVHC1pCZ7JhjC_XYiVO7CvBYpDx5Wkz-CSoXtaA1xZ9mJg1OGCrmpLAB0OhjR4YtTBEtUBP4HJOIb62QmNBALvUVKHEEBPB3F0nwH4F7OW1XwfTCVqTDoCdH_pqBP8ueWujZEQOmx81g1HIcAkU_yldIlBqvbFPVwYj0Ebbpl2NkwshfFBYq8PTNaLQKlOAVa7Wq0Kt7OqvBfbjVs9SQPWvh15uIzxRs6WnBHUpAcysI0xlESpHlottQVHxPp4Iu-iL-m_PKRC5HCVdQ5WII-pHm7Mj6JEB6XEzLO9b0gwK2GcliuOILh1XL_GweB7w3ES6rYJQXoLuqT7foUEP8OnDOeYtiZ6Xy_r5w8QyDnJaCZNdrLumqiNdBVwoH3PKnx4p7r6dkCvwFTSdDXcH6kniGVPAKGXpWQqID6rlLap0dgAWjqmpEh8LIZ-uSHuXgSBpGtH5tmD9zV2Jm3rv9JcM_bIK66CJYRKMot7H7_1PM2TaedVv12qzGggw2KFliAhXDTJ57EIHa3lzGVO0zRZA5oTe6GpUOoj7Pu3lRCbXpA_mImUqyaDIVMM4m6hno_xyxwLrbYdXgaCBdkPTnxrFAOXZmSXrpqjlj2Re9lErSRqUr_-femdpi2BaF-VbVrdbq9rwny8Gh8MDKg1SpVx0GVNKD0rctAOQFrHegrcheCqNqUhOghMYqd0ZVJbpc3hestV_ZJumWmXSVwrvWMBo5BFA8NaU-FhOyktlr2UsxZfUHRmQ2Cz-uJRQ1t8cDOzDZwBS-LNvo14PdQt_liINjA9hDha0VGDyT9l-MGft2Ds6aIxzdrdHC3bqQIZemfiILf0jnoXeN-nmDaIa1jD4FPTI3hIfL6gK3cEYMGm4U7MREjDddA5O0OlXjTroQowfagGzvUCv_7Fy_AG1phOvhXq6Iy_ZplR9_bfUxOhTacaa7FE57tIoBweUprwirWhB5h6Q3QR6PraTo_4gfRi1c4tPNVJTUHhE7ee_QcqGG-7AbAwqg9aaPuiXUih7cgd-s2JhZcj9RJ-rk26bIck76D4jW_MMQupWy-2IM8aSDvRFDyCyXmVzC5AidtAk5nlxqwOhvsZHrwuHwmvFDFC7sHyY0ebatw-NDGk466GKl7RWfoLGJk-9Ip3EBNE47bQeqSC52qQK6Z1cr3loFCT43JQMS2PZTbdmsuMwGrphoWicGlfLFaxbESTzjcIdort4vrRUu1EXPsTCf-cf6D24FKPKJjJiVDl3c0Ubgg7CZmcDx8gu0wzxOuk7Y55AAXWtV9oNcM6VNTARutcI4-O0X_iIX4pdm6ZP4D6wELgO4o572SJvyAnzqEicgQMWocaLKlEvAgDVlmV8CQbzE0ZXgFPfW-BngNGz6Xgjh9zwnXI3BZt5_pkr8kFFJp_HnzewEKJ7roPS8fG6dUa73Rm63U4m8q7LQ&cid=CAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=768214845007660000&adk=1033480540&idt=57&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

309efd57429bf1331a8d829a098304980d3a23f7b0709a8ffd7fb58617f6ef59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20369
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame 9C3E 59 KB
14 KB 595ms
34ms Script
application/javascript 54.217.43.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CCYYqHvzXG8wCETacMwMhM2S38lQKARZV_xVrPUUZpm9XcEkyfPxCAiA0IfycQwFTuqktJcWBsUBcwEWQGMCoPm0XTGcNabenILsFvzgBP2O4HeYwcYUY8onUGBcMTsOMLoKcT0aR8JIpC3C72GTwopH4dnAruFYjophgTBiVgIpagWPHSDW9sz-bjRNBammphqGl1Mx0FHzgo6dQ9hSe4rv752QYeQA5hsCuH7BrgF7vh95s&dbm_d=AKAmf-BK1n1M8cG0BR9T22jsQ5qGPMDbqh8wUW_tr2H3yuskNQKygrvKmupgtDwflx9AptRkgfkIlktx60_JqLQNxVUShqNijqSJ283pxtjcDQohN2Hv3Tg-zl_RfUdKNnumo0lchxfI0yhVFuu9NXA2OukVtpPtQ6DaznN7vs1HdrWBlkFsIpCWahiCocyxJ_AseHS3QUMwBhG1V7_CoU12-bXaOi1SXNzjC9QsYxIX3QLtxm8RxS1q3MD1jCPUpiiiE1FVN88Uh-dwJozgTGi2u5N_eRc50NBPxzcnQQGkNrRDmtYrU3TXCJijJmVjiEPzQVAKBNAuC5hTGqhjJhBBbIec3M5tJSJJoFENfysfjRAgsL2SLnGFrXxGl5IUmKL2gF5H_jOrvD230Nee9h0Pu8jyERHpr5KlLf9Tzr1579Xf9JV9U0oakxrd0n-Tvk2Sd4F3RswF9U1hwKPglRFC32G502TLO9k8HLKwBsQKL4RYNep-TGSF8eFA7LjzM9CG_6_5_VJmbtPDefOZ9SEf6cvWdCJu5N4Y1H8-SLqdYPXlKI6FQDyRV1SK2Hteg4R8PLuuZN_vov6NXQd5MytICWqh6ZHaUy8ZkTx9TxIQirhyPeQwPC2OhXE7vjsJgDwK3HQBcWvIsN1R94hZuQxilOewY78Qs3PBu1rh-SqIpW-jPsEksHtJGmmsH9oqhcRfjHyOGJeBl7BEuaJEIho_aY78audFbd1Mg2lUP_o1W8fxGGIGw2hit4XKR9uF1v6YwPNLcNV0pHxejEmsWv_j5X1wtcoj_mTd3qa_T1ZT78q3RhWPCb0pGyf3pa0LSZ5wHjUON-dU-9CQ3BSJoahQUMFutyvUNkhLpdo7iLbE8hRQLfD2Nh6ZDc5nriOnuZDvIG1nq2X4_qcg5jutMkUDDcxYHyjw6F7eunhCzWxFie7BGGRrPFjC_Hi3TLRTjlHrFZOmHoX_JbCj63W0ZX_LKmYwPoPBoDRZY7b_w9yeJN6F3nVAV7GmfE1LdtKbJprTEhCbdZgCp0ta58QNjO-UDsDwzKV2yiuzdaJaTml6jYz-QtsEnSjLnm0q9Ak1VWJ9Zob56MUhkxCjCpOxDVg2LHelbqEvfijPkqUAdUFNYArakIvD9Dn2cFNHsB81wFihs7yeIYvUFdalA3Kl8h_aStZZTkJLA6Jpmzyhz5WBXqw8ZS-cT9-f48Wdi3-81SebhcM7m4myUYraBEvQd-1IkX2HSh-KNVfIYsu8rrWbngh1lEdk_jKdqDGwm-8Z2ww-Onoe7ROy2V_lXhL-GQC31jI1DhrAWFrSi-aGbxDq81dZgOK65A22bkHOiYA37tnSf4xgUqRj4yEk0pA_Ys7grVJvSV80bgrCKNaN1G18e5nydHycdh14YTVtm4zshYpkW0IiXDFLGgMkqtNPA9bsWxGENRdj0JiARL85U4lpmFKmWchoVb6Q4MxSRV5OvBI-gw4ae4NOZXb1zDD7G_akqYtHP5YpCp4n-J72XjRNRJtW_PYkH2GbxLFitCbHGHRLLThX5Ft2ZvWpEJEzqp72w9iPG_zwOcLrM6tXyS55uEsfDRgmNIb8kBYxs8RX6t0y_IdgWOnYPDpOrhJ4uC6lcoWDExiZjvoJEbXwwuI7IzHtHUW8rAtgu164vZz7NkK7svjKxAP2P_gIXJ_a6nDZ2c8u829NT-ezgIFdxNAUf-IJUluXHwyOIlC3ugCQtFEpNDPmIzSWrCWTPzrVDkl5RBVpUrK8YfZ8QoVO_2Ye4D28jo-JJ7v_kg0nNmtQrwP93Is4FINjWbHSJ1kerwT0aU49Tc2oQYCKZDHn_-tzn2IcA-WsRoYajZ1Cq9ru5B8L4QLM9mbTjLkAf9IvDQs7BS9Zay5VumOeX5QdCqPZwfkcTi8P9s_cVGjA8aMaijNZoxSmFtklypRiPfr5_IzlCaeOiCM5-l_zqM8loTIvEGh-7ebXV5sa13YHswVg7H5q25LeUQ0tbr5scNCmOPzwfcQRpnnVAgnaWSAccZC913Ef9_gQ1R9SQVjWv2b_1-hcXUz0N42bsLaV1ZKf1CDzdjDTBPWpvDTuB80k7uebSvw3f3VabY9u4uhTlYOKaUm6h7dB_hfiIB2gi7X4tYGQW7qIp3Pe7Ia0xyRCnrWB1wbxZodQytMqtC1SCv188YHgqgIoClK6RIRENhf6OM3G_hVIixRYDy4xm63YEmtcm7OZl9qe2nnxgnbAvGlYAnpPtkd21oT3QxXXTCeGOFvYztRkHJn5IRW8lpOktJV2lm-s3hkFhjQYcs53iSh45SSChoFFut-GFfKPgPZvV1k-ukVnevuX9pErhx52PMrwswc77UxfFBUzedBqTulBM2_Bq5L5afHrVKz1MDt5i_d-RoC7cTtYkPFUyTWgk4S2OwSXoWk6QMkhbbwJC7S1IRsZGlU7M1WwLAHNOMWBIgJj5059nH0-JjIjD0BBxKlbCtkm1RuhQUKIPOzpTz03g4LJalHe4eYd1CGfQKCMwuu75Y8v0zQgqTMIrsOPSQm6ATKyuLuZCWz532PAGy-xgPPoTl69ytgg1fifXBsi1UrolOn_Uc5NobJKwCsM-uiy7bjm4OjdkpmJhyXTmeW8_CNlbvAhfbBQtCmb2jo051Fggt7Ls5bmuPlYdIXXvuzNfqqU69wwU2VGH4r0lZJbojQLTH4qjBHCCTZqcqKfxNUuC80QDkdyHvHBwozmbW9NFPbKIlXmcLef65_zxYi7AVY-Ie8pIepKlr0g-q5izg-i0xiSSpqyzVM9UnHIOgQ2gqZo6vH1FY-Qx-d1-RE_lymmiUVxyHGIWAezVYy0LI7B7qFE2yzb1n84r4LNZoczUOJl4sfuXQQnQiHj7tN4jTZrU6M9i8dGh9DDsTmQApKlIlyE5wMvF7M9nuHrBT3f13IcG5Jg-UrD6n3-U8Xl9wYFmQAgphmI6D2SdujyFCGmulv0BEf0tk5mLx0I67HbB1H8V0iZs3bFHU2oQffcSFiNn2ZSTAGcW_YtfacL3O5BJtLvGy7zJ8QYwB51J_8n8SXkxapYaTiEMotBxd8ZvTR7Ga1KVPE4RGQJsQcX4k6qNnvcWiQFyIurX8rMvnG9R0ZQeKfRxCjtRNh_VoH25lU7g2-gYiTfkIBYsj_zgdhhNaIx-CdkXjKVlSAUIyHm3VEwDsr1BJrzQNufxbZIGSlywht2aUidyQmsa0_hI2mEv1Q7fO5p5Xpu3SHEyS6TadK1avs2TctBXkfs4-dVbXAVFRF2sHRd-foROfjmyxKwt7kEoqgPnCfjDP_EnB2TkMmoa3bzpiln57xjcoKCQT1cAIPCRc_OG0gtSkzWFV93P0fIoKCfDZMAuW74zeIpH9DhL3Y0xEke2JsOl0kzuqdHrk4CWBy1cg0pgJoXO-Y3vIYQ3smdLSHC450T83vxaZRZFOZ_3EyJqz9AEm3FJW6Jljsq0McIz4YJtk17aJAW4MheHIs0LrhSyUXzMCyFzrMXxESFUtZb9Oa2sM3SLqbLSiJjmnHNekN9gC7HtCE7CLtHf6-m6z2shPaxGr2VXwWlwlZgFB2X1ed7TcE4alhvEiVdPMVOEOegA7-_s91VxtxSCkgYQke7mzazTdXi2bpTQzdNsJObYejhNiBb14VUAWs8DE1PAvqjR-h8YsRjRl4sdAuYOZ9vo0-CxSK8dh5FAocL-dqTBHMG64BEH94vCCMzMnQS3fc9nytz1Kjd9ZyIHnkDcTMWlmD04Sfh3SC2duryM8R-nyrZkZQO_uZj-ljzKKp9fqjK2T1sax5Zj27xB_vTAz86o2ld4B3m9hA5d1PDOLFWrvDBuY-io6f5RIxh5XJJVm-u1cJTNQBrFIZTU0RyJhoUZ-3prA99_Jkxje9TVWr6Me7WdwrSUAgiXRBd61I5THLzRJnSbQTU9R5BSDFZKZQDcnTrgoQiBpd28CKL-XfjmJQZ_YVBJgBmuZn7JU7D7tBpBs2GdP7aoC9ln4vf8LGT9mmP4yC_gCoB75jRNknCGzoB9MlpveRTgupb9gVbbNdOkbBj4wxtN8_CWgCTGo3_oZFBpcGyA5yBZVeJs6A&cid=CAQSTwAvHhf_64GpKZukmahSuPYJbZDE8pZtzQvjZWbzvUl7uBp8JC9Y-rJTYgJUZxGGsf61Oq5ZkODP1kDQRQXwCkiZSpm_YOZeQigzR-A4Ye0YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=10555165476935340000&adk=1964084971&idt=51&cac=0&dtd=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.43.2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-43-2.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 0381a1f94458d3acd757abe9ac9fb14bdc6e24d846fb90860b20636171d6ad0a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 9C3E 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CCYYqHvzXG8wCETacMwMhM2S38lQKARZV_xVrPUUZpm9XcEkyfPxCAiA0IfycQwFTuqktJcWBsUBcwEWQGMCoPm0XTGcNabenILsFvzgBP2O4HeYwcYUY8onUGBcMTsOMLoKcT0aR8JIpC3C72GTwopH4dnAruFYjophgTBiVgIpagWPHSDW9sz-bjRNBammphqGl1Mx0FHzgo6dQ9hSe4rv752QYeQA5hsCuH7BrgF7vh95s&dbm_d=AKAmf-BK1n1M8cG0BR9T22jsQ5qGPMDbqh8wUW_tr2H3yuskNQKygrvKmupgtDwflx9AptRkgfkIlktx60_JqLQNxVUShqNijqSJ283pxtjcDQohN2Hv3Tg-zl_RfUdKNnumo0lchxfI0yhVFuu9NXA2OukVtpPtQ6DaznN7vs1HdrWBlkFsIpCWahiCocyxJ_AseHS3QUMwBhG1V7_CoU12-bXaOi1SXNzjC9QsYxIX3QLtxm8RxS1q3MD1jCPUpiiiE1FVN88Uh-dwJozgTGi2u5N_eRc50NBPxzcnQQGkNrRDmtYrU3TXCJijJmVjiEPzQVAKBNAuC5hTGqhjJhBBbIec3M5tJSJJoFENfysfjRAgsL2SLnGFrXxGl5IUmKL2gF5H_jOrvD230Nee9h0Pu8jyERHpr5KlLf9Tzr1579Xf9JV9U0oakxrd0n-Tvk2Sd4F3RswF9U1hwKPglRFC32G502TLO9k8HLKwBsQKL4RYNep-TGSF8eFA7LjzM9CG_6_5_VJmbtPDefOZ9SEf6cvWdCJu5N4Y1H8-SLqdYPXlKI6FQDyRV1SK2Hteg4R8PLuuZN_vov6NXQd5MytICWqh6ZHaUy8ZkTx9TxIQirhyPeQwPC2OhXE7vjsJgDwK3HQBcWvIsN1R94hZuQxilOewY78Qs3PBu1rh-SqIpW-jPsEksHtJGmmsH9oqhcRfjHyOGJeBl7BEuaJEIho_aY78audFbd1Mg2lUP_o1W8fxGGIGw2hit4XKR9uF1v6YwPNLcNV0pHxejEmsWv_j5X1wtcoj_mTd3qa_T1ZT78q3RhWPCb0pGyf3pa0LSZ5wHjUON-dU-9CQ3BSJoahQUMFutyvUNkhLpdo7iLbE8hRQLfD2Nh6ZDc5nriOnuZDvIG1nq2X4_qcg5jutMkUDDcxYHyjw6F7eunhCzWxFie7BGGRrPFjC_Hi3TLRTjlHrFZOmHoX_JbCj63W0ZX_LKmYwPoPBoDRZY7b_w9yeJN6F3nVAV7GmfE1LdtKbJprTEhCbdZgCp0ta58QNjO-UDsDwzKV2yiuzdaJaTml6jYz-QtsEnSjLnm0q9Ak1VWJ9Zob56MUhkxCjCpOxDVg2LHelbqEvfijPkqUAdUFNYArakIvD9Dn2cFNHsB81wFihs7yeIYvUFdalA3Kl8h_aStZZTkJLA6Jpmzyhz5WBXqw8ZS-cT9-f48Wdi3-81SebhcM7m4myUYraBEvQd-1IkX2HSh-KNVfIYsu8rrWbngh1lEdk_jKdqDGwm-8Z2ww-Onoe7ROy2V_lXhL-GQC31jI1DhrAWFrSi-aGbxDq81dZgOK65A22bkHOiYA37tnSf4xgUqRj4yEk0pA_Ys7grVJvSV80bgrCKNaN1G18e5nydHycdh14YTVtm4zshYpkW0IiXDFLGgMkqtNPA9bsWxGENRdj0JiARL85U4lpmFKmWchoVb6Q4MxSRV5OvBI-gw4ae4NOZXb1zDD7G_akqYtHP5YpCp4n-J72XjRNRJtW_PYkH2GbxLFitCbHGHRLLThX5Ft2ZvWpEJEzqp72w9iPG_zwOcLrM6tXyS55uEsfDRgmNIb8kBYxs8RX6t0y_IdgWOnYPDpOrhJ4uC6lcoWDExiZjvoJEbXwwuI7IzHtHUW8rAtgu164vZz7NkK7svjKxAP2P_gIXJ_a6nDZ2c8u829NT-ezgIFdxNAUf-IJUluXHwyOIlC3ugCQtFEpNDPmIzSWrCWTPzrVDkl5RBVpUrK8YfZ8QoVO_2Ye4D28jo-JJ7v_kg0nNmtQrwP93Is4FINjWbHSJ1kerwT0aU49Tc2oQYCKZDHn_-tzn2IcA-WsRoYajZ1Cq9ru5B8L4QLM9mbTjLkAf9IvDQs7BS9Zay5VumOeX5QdCqPZwfkcTi8P9s_cVGjA8aMaijNZoxSmFtklypRiPfr5_IzlCaeOiCM5-l_zqM8loTIvEGh-7ebXV5sa13YHswVg7H5q25LeUQ0tbr5scNCmOPzwfcQRpnnVAgnaWSAccZC913Ef9_gQ1R9SQVjWv2b_1-hcXUz0N42bsLaV1ZKf1CDzdjDTBPWpvDTuB80k7uebSvw3f3VabY9u4uhTlYOKaUm6h7dB_hfiIB2gi7X4tYGQW7qIp3Pe7Ia0xyRCnrWB1wbxZodQytMqtC1SCv188YHgqgIoClK6RIRENhf6OM3G_hVIixRYDy4xm63YEmtcm7OZl9qe2nnxgnbAvGlYAnpPtkd21oT3QxXXTCeGOFvYztRkHJn5IRW8lpOktJV2lm-s3hkFhjQYcs53iSh45SSChoFFut-GFfKPgPZvV1k-ukVnevuX9pErhx52PMrwswc77UxfFBUzedBqTulBM2_Bq5L5afHrVKz1MDt5i_d-RoC7cTtYkPFUyTWgk4S2OwSXoWk6QMkhbbwJC7S1IRsZGlU7M1WwLAHNOMWBIgJj5059nH0-JjIjD0BBxKlbCtkm1RuhQUKIPOzpTz03g4LJalHe4eYd1CGfQKCMwuu75Y8v0zQgqTMIrsOPSQm6ATKyuLuZCWz532PAGy-xgPPoTl69ytgg1fifXBsi1UrolOn_Uc5NobJKwCsM-uiy7bjm4OjdkpmJhyXTmeW8_CNlbvAhfbBQtCmb2jo051Fggt7Ls5bmuPlYdIXXvuzNfqqU69wwU2VGH4r0lZJbojQLTH4qjBHCCTZqcqKfxNUuC80QDkdyHvHBwozmbW9NFPbKIlXmcLef65_zxYi7AVY-Ie8pIepKlr0g-q5izg-i0xiSSpqyzVM9UnHIOgQ2gqZo6vH1FY-Qx-d1-RE_lymmiUVxyHGIWAezVYy0LI7B7qFE2yzb1n84r4LNZoczUOJl4sfuXQQnQiHj7tN4jTZrU6M9i8dGh9DDsTmQApKlIlyE5wMvF7M9nuHrBT3f13IcG5Jg-UrD6n3-U8Xl9wYFmQAgphmI6D2SdujyFCGmulv0BEf0tk5mLx0I67HbB1H8V0iZs3bFHU2oQffcSFiNn2ZSTAGcW_YtfacL3O5BJtLvGy7zJ8QYwB51J_8n8SXkxapYaTiEMotBxd8ZvTR7Ga1KVPE4RGQJsQcX4k6qNnvcWiQFyIurX8rMvnG9R0ZQeKfRxCjtRNh_VoH25lU7g2-gYiTfkIBYsj_zgdhhNaIx-CdkXjKVlSAUIyHm3VEwDsr1BJrzQNufxbZIGSlywht2aUidyQmsa0_hI2mEv1Q7fO5p5Xpu3SHEyS6TadK1avs2TctBXkfs4-dVbXAVFRF2sHRd-foROfjmyxKwt7kEoqgPnCfjDP_EnB2TkMmoa3bzpiln57xjcoKCQT1cAIPCRc_OG0gtSkzWFV93P0fIoKCfDZMAuW74zeIpH9DhL3Y0xEke2JsOl0kzuqdHrk4CWBy1cg0pgJoXO-Y3vIYQ3smdLSHC450T83vxaZRZFOZ_3EyJqz9AEm3FJW6Jljsq0McIz4YJtk17aJAW4MheHIs0LrhSyUXzMCyFzrMXxESFUtZb9Oa2sM3SLqbLSiJjmnHNekN9gC7HtCE7CLtHf6-m6z2shPaxGr2VXwWlwlZgFB2X1ed7TcE4alhvEiVdPMVOEOegA7-_s91VxtxSCkgYQke7mzazTdXi2bpTQzdNsJObYejhNiBb14VUAWs8DE1PAvqjR-h8YsRjRl4sdAuYOZ9vo0-CxSK8dh5FAocL-dqTBHMG64BEH94vCCMzMnQS3fc9nytz1Kjd9ZyIHnkDcTMWlmD04Sfh3SC2duryM8R-nyrZkZQO_uZj-ljzKKp9fqjK2T1sax5Zj27xB_vTAz86o2ld4B3m9hA5d1PDOLFWrvDBuY-io6f5RIxh5XJJVm-u1cJTNQBrFIZTU0RyJhoUZ-3prA99_Jkxje9TVWr6Me7WdwrSUAgiXRBd61I5THLzRJnSbQTU9R5BSDFZKZQDcnTrgoQiBpd28CKL-XfjmJQZ_YVBJgBmuZn7JU7D7tBpBs2GdP7aoC9ln4vf8LGT9mmP4yC_gCoB75jRNknCGzoB9MlpveRTgupb9gVbbNdOkbBj4wxtN8_CWgCTGo3_oZFBpcGyA5yBZVeJs6A&cid=CAQSTwAvHhf_64GpKZukmahSuPYJbZDE8pZtzQvjZWbzvUl7uBp8JC9Y-rJTYgJUZxGGsf61Oq5ZkODP1kDQRQXwCkiZSpm_YOZeQigzR-A4Ye0YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=10555165476935340000&adk=1964084971&idt=51&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 9C3E 12 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86024
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:38:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9C3E 0
0 91ms
48ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst60Lf8VNNbfyVLmeoGPYyMsTzZVvHr7MATXQy0w3lLRcQ7DxnsKhKbi-9e7JOUhxKRZLi58YSyuokt0yerv5NLkzRY-qpSJiHP72hIsPiEhELHKIlM7SYI7hhHItBNmqnf_RCqCCiYNRQF0X0JEW6JHQmA5BZBPZV1IkHH3_EF6Ti4CZI6MSzl9q4mtfHcdZ6TmqgRgKvsnQrgi0cfrmelwyZYIZanQw6ZpxmQd6G43KAaiq2iIQhOTtCKEXVCNpvqHI7fFcwPbENcjUzy-G0A2Hs-nG-Zm8mOpJfz85qaM0zMG2igUlCgB3AoLJNnyFW3k7bAi2Vl25UUr39-UgZDEAn1wwJ-f1Mw3gjM_0jPkj7fMmG24TJqVcuvC1NnrInZ0t4sUwy2qH_mEUsCRQN-cJyKcmCgZ74oZsQUOvhTwYWmUHiioRxUWBP3oCservVQQuTGtcOzse6MwiM4FwJtCYud3sfbdP-WG3MXKK-_I9cJMF0AMG13SsnobDir1qNtVFqUp_aWC4_yvky5CFL9o60SAaGYWq7F6psIGO58M-PDh2KQ8gdNfi4LjjcQsulK_csl5g_p867DPhac5Mc6wJUXu7ADQaVYlIcwzDYEhi3gcVWUXlBuA-e10l-zZu3r9VK9OhPhdkQwCT-QRbQjD3-juTksdMnaf3DJHlmzsU_OCcgmC5ZjfkXxK5j7azyG86sEFm4_byhQJrUrcyq_ALTA_W9-_68TYC0Yny9i7CoYLnpV9QEGqGnFKBOEcpTYb1TQ0mHy7aK2vZMzWfwHprCuqE5M7vLd7boJbFlQ2Rq69TcDz66vsZfUNX4MJ6PjsuW11k-Hwr9nhIHkPiYJ6caqTubuD5tJ1NQYDbSF8a2PTiJnSc6GfkoHtSzCZx9zKu7X3jE88JMU8Y8ZG5SZdn9UU9k4cYNIwAFgz0m6xIp2bUJY2ZlSsvsOhY42goEWuXrKu5I2tZBbmv28oYvFMCZJBuAArhM33wrkQUAkN6QZw2zBUw3WobWrXky78U67BAOGRBJdUqRYQx_Ruh-c9O6LaDpoE04tQjpqVre1wyoRxkBQVzEDoPv1txS17OhogppU56JwpnVxzAf9UaGkf6c9iecthJVacnyjVsScZg6MLrrn_5lHeYpUAINMDW5Hqq064h4lMxWlGldGhcH_dXJNtomaQsJtgGciSI6yIrsD3_emlQmIDv1_W-R8VxiITVkH3p0s5Rr1kygOA5tpyf2e7NZRcStHncGViGx3FNScjpRK_mKrAU1mq6EAB8kK_T3okJiP6m9Tv69wDxCF-a7NkjlebysdRZFfjTybS15HjuQ26fhFVg_rvHYT_8D6ghBpETfXQSf1AV1WV3xTvcxSsg-6bGhnmncNqTdGbnsDamXYMCYZz4RnLtZSp9e8U7cbfEWhITVZt7wdMyTG1olCtvUNo0Pm85mejx_89M-04gI58F9BkVYoDB4kSkmcsOVru80Fb3-8EYKebA&sai=AMfl-YSKSbYwVN7gm7IMj3JzWjLlu5pGjGNEdNoNmJh4Q6UYEl0dLgwgNcuCtd6I4cFrMbl1NUbvUpSJ6dYkuE2tyjj7rP2uHvI74668_p1VOnZ0EXRCxomxA7xX7MN-ghxRLlsISp_chEBgHlm3LwttKXV0A02OY13Lk75dHJoKTCs71Yv4BOjG-lRf1oDXhXZDzabo3iga6o65IwpyL7K4bHzRA3TYTxovRnA9v98eXcvf2b2jI2TVTVqM-DXzIPD_lotC8_YxG-8VIkAz1dgy-MMOR2vOR770XK8dFZ2KBGzbuTkEzpDIzOEn0vzj37fX0Dtv&sig=Cg0ArKJSzOdcByz0VKNAEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240214.06185&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9C3E 41 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame 9C3E 54 KB
54 KB 25ms
8ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 330438
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 120 KB
24 KB 13ms
12ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8197645a095cf1ef08a270f9ce62e1292b7e6fd0c5889451e2ecdd8d7587f352

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 286921
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 24833
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 08:49:59 GMT
expires: Wed, 12 Feb 2025 08:49:59 GMT
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame F05C 0
0 49ms
48ms Fetch
image/gif 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssQaJ4GhPXcpq5Wgs9PFu28FpmaOiRgH22ds2eaKVdBxgJ13fH236rzDoF_COTk0CT9vEzBFzahJvnzTH4NRpbFtLyLjUTMtOyfGHqRa-fYKxkBe3Mz-JWNJqdHhxVfQYMojyvSmC6LSWFSrqFAojB3aIV4ZpN7xJgOJ_VZkUENoy-WsVLpoTTdB2NT00QBOZ6Efr71WGRKrXj770UfwROcZVwlNB2gbx4yDf142vDZ13kvbFnBZvnnNGl29l-u6KPvXOBkTZN7tVcPVm60yf9q3XOYvA1k59HCeIy9xQJErFf6K1qmd2SN1YYcmisdSKOgZq7GgYYhI6JO9rfBJSfqaFV01q6o3HxIUhimtp1S1MxZ-K-pJB_YCZ-mcdAFsEcc92AscFTDacDunuGe-AVPnaJatrFBjroqHZ00gmw8MakYvgo12PWWQXgxveJ7JYCTJJfoQiw5UMGroLF4Q9Q-vrjb9VgMGkvxuHjVNYi_47BbYTqf8Htpl0CwcYIk1RQVv5iLBWhtniDDHwngj_3PlINJQYPdDYNLNLR77ACbNvytQr1x8Xx02KBLo0K_0m-vsOvhEJDXBSHAH6ipvBzKlWFHt98NQqFd7Z4xccFj2R1YY6XDEslv0ZZ8gNkedwfZ3Zs6K_NCcQfjU4mt7u-DndGPJ7fGGseXKy7JsmUdj2KIxekZlgz9fEIhE0jdhRW8PQiVPdkdGcekXEM82ar-WlBOp55jk2W6KUO1lIr5SLFCbe1KgC7jfh6BATCH_8TGQhFdHkJdW45XMDESgiG70eCftqXkYCxj2j8Lf23HpCVI7e7On0C9qOUIwqbFa4hR59XJx6e8xTY_KXXLFNz0viokyNlB5i9v-7YtM9hztRM5H5WkocUXBy2b4-WDYvWHkFf0y8LxU-hLhWZTudxKG5V6Akasbgr_TF320CQnk1TmFJOSshYAny1yNsqC7XBIHQ7avoFvolgwB6Qp37FHxGqSOuhnXVEmEjg1LZDSa65-qwQlmLHOqOCtZdxux2FOBfJfB-0JJKk_AzJpuG8HOVcfGwFbyHQLIFAWjEoZaZfHWYth4VJexw6hQTNAXc8DjyBHaw-mW5Ai9nFcuqDGqUtCuggcslJE4vTTgIRJb-M57c8oGNuxkgu3CHo1BG5fyw5JV2Exr_rsoTnAwYdJAl1hyJPXnxAi-FUgf8zS-qfXoffZOBHUqUmaMSoj4I-7_x7z5jSkPbYLkV99iV5kDvQDG2u20B338XZwBAL2_WFObxk2xQk7yoYw3cKGjzlyQu5wLQUanmSLErU3Mezu7p91Hvt8rCQme6ddvZiy-vsOsk5Gz_yOvD9fWPBUXzbb0gXW_vmLLnKmbKBZDqnjqF74W2zCm5Hep7tdVJp2QxlFSo_z7aeCU9jj5jsqBNM0mpOVXuoz34ujrWCcanZc7lbK&sai=AMfl-YSo_73nF0esFSSDoBFFYTSxpPlpUooisARZz708Dx3U_vRUkmr5m2ALdmchLgmp4erBMUkVbPPRNwfeGNzA5kQZ8_m--WlYy4uBruOFuEV7iYmcW0U6L-buX-Hi6Yu83iGrvylorg0OLPhPyYYuPQZtr_J52CI6Ad3wjR5sZ8jhzHkYJyypGz-KYA7D20kGKtnmZP8KiIu_QKSq4wE0D1g9-ufp6FufRdMU4ZBmWpFD6jvARMJgD794RI_Zm3QI_kjwoGPQK4MjnyvYTZ--t-ba3iiWZnx9Ufw5OhYcY1ZAnsC7RNeRHFpXAIk2pLbFyz-M8fGvVUQQCQoaoKBn8dPJs9ei3PUQ3720WRnw_kUoCdrGvOxyCzDp776t5FuW5PzCkv4FHI_ynnix_tfZlUfBjd4S_gcJVafdjt3V9juxXDCG5bNl6VKIe3t0KVdRwkjFWLR8F8H7c8xYJDp5opCTzRsF7LN1CQJv3X91G3WhqV1X-DsgMhv6eSU890gx6FRni1MH0PfB&sig=Cg0ArKJSzFn75TzaCGtFEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9kb2Ntb3JyaXMuZGUsaHR0cHM6Ly9leGFjdGFnLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=208&cbvp=1&cstd=203&cisv=r20240214.51437&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame F05C 60 B
60 B 81ms
20ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=72409-dcm&extLi=31549419&extCr=210538338&extPm=387998189&gdpr=&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.71 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Fr, 16 Feb 2024 04:32:00 GMT
X-ET-Code: 0
Content-Type: image/gif
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp: 263
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 2961 30 KB
11 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AX9jojSNDM3jVl-dYCuBUAvzZGyB45W653gTckxdScp7zKMVRI9UtC7s9x1lzTJeRs-m6KVQ2GyabyrMxzRnBoe3bm_itatInIXFLVTkNKCVxQjIixOPOVCqFlLYHAgVZqhq6F3IzL6cNfbgexLIU9rD1Tkc5K2j5YSRpMqO861TZ-laA&cry=1&dbm_d=AKAmf-BWsVdCx3AMEVAWKDxj91RBMDfFvNRkVygKRDN-xySR4BssaFKGyw-R_mECRHTPB9kKnEjhhK3NNKMfkm_MKCV8xxZPv8y3zBQ52iLWOm8eLOICOQB-R5IfxsehHhlhVKFEsj4avr9BSDinQ4qBsiGYI3ve4Kp-yNglho4aTzXTroKrkJDQL1bW3b3e8OGw7Y8ID5-ipWLV6LQDhsXphGngZ0-qjbtVw8LUWw_jDHY6lSmG6l3UjYW87odfmBVDr5Xn5DyYlFbnUowmCXMf20ESkSDyrWSzUa0EkJFhpnzabUxdJ3g8UHJok9992Y6LtWz9ZjUtCa7o8HutuUU9fpRwtSo7yIL6vBNkOouQ7nmNTRAt-1EgG81FrivXXs0JFzLvXqRc3Ru-BIehFE4cZC847OiPhjqRiPRXgdpVSsXJ1CiQR7iXFUpn9NvM8T94e3p8p2WmrpWacBzoD6bw39NoAdDLwIC4N_JWyMdD3b50JowgwV1UW86s7uAha-6bI7P5oTMcjbTKw1OCSviC0Ipqar56g6GxUMr3yqNDAFKrQUaq8ZuiGxjMKsCnAkJ4fgwv972xA8Hy51dwP3_LXp2w8i1U3qOTbvBiaQlphZ5W-afKvxgdFE5OXJHGimgx_BmW0he8-dauJw_46Pr9-557GG7M6pOrqKJdSA04WRaLyRxiSasW_7-3SL6LAHwIkeauuw9WlXWCif6rS_AO51DSEuNjUINzWGfgTk5ta33kw0dnRS5dBqvw9RNdG9DhPILD4wxjWvCldodERR_8rfMeZfCrPxZy8w-8CeF4VCTfgwGApzu21bpbZ-BWwNpLcB6hzOX2JxVp-1x3ffVv5CnfTU1S5ml-0RcFwBMxi4psT3RZEtNZJZEcgkIAMft9oAdclaTPajHRbqGkypOKUBUwMaCnzF-SUfaOYJGKIYZD2OwxWT73oEV8YDLXFhkHn11175VJH98Fd6_TfC1gZ-Gmj6rHXR8lC3J7uC-UAbZ0R7Njm2hRNOzoA6ltYON8tUdzmm-qU9PRSrccBt8P34w2VILNDaiYKnbVpGlhGE4zf_gWezz9DJm-uCJo_uoCPn__Bj9ie0uWEv_B8NA7yra-azkl0xYQHqmdqhgjBmtswePyLZuan0ICTsbjxvXLHaF-35WT9qfmlRbR-Ho_91V0MnZFGaX33PGW1-kocBYeYQ-pFkTP-nJ53OQlGtPKZO0MhAC-wOn2YgyKeJYfvhCEtgAJ_FDirD-CyxuT66Yt6DWY_3Xk5a3DqkkYU82jRYE3-aVvFUluj59atnxHwq-igQfNPd50ghzwpQLzeEnN4869fl6QGouQlyjoYCeEpoSMxjDh2JBYXg6lqHc0rbwRfxFqabvo4hubU4clgMpICZ3T2sdXvsk5Ej2idI7U4SERWM9pF-T-f_dv3tohjI4re_C-iJzKek00Ea2HRFYSDNIJm5qXJGKGwFjuPckwq0Lu0Tt3_-Y7xN-1hOohU2KELBTDFAquaWgZ2VsrrnFBDhgiahnmVLuf2784z3W3nJ2vkcwVUpOMScl6JQr_oKa8Gt6CIDxoVBAoWjyPvLzS3_yD4GS4BntukR3W4FkEwnfhWERvN04REuK7PoKnjDdmzgdnChYUu-cq9NuGTmctjBjUVt6lLIVtgqIhptD0L2VMjZjeneeOcSyB_FgOAndWYzAXEuIACmxuouxUfc77TSKJJ0OkKxbRWJnq2WLC4URyKAaZF-w5QbE_SndOeFUUljR5l8RConsiIxjodXMQuyYr3dqgvyaJAZoq66b43kH4nu4o9BVyT9mZ_uhFJkNdua1Ys53BmO50Sn5AQYQTdPbNJLtvGIlTwmKub1uv9MOj-_MdH9_5B9V0TAM1eEE_MofWd6GAUGLN5sG9HdXKgcOkSmgYJia_aaEgNYlWfpk5PdVXV7ouYpILVdV2DLhGbsf3Gm4ltukzhwjYtp3edH_GcO6VFswoez7Wx2qibHP7pDNCSnw1jLZJ71oyqViUYYvelRv2k481ueileyAW7FOmOSnSl4-MHsKTzuYgP67VaDjbXfvxFpgqp2QBGeINtAFIIfw-QWDEGCQxIIo-T7mC5faS024AUOSVpd_ZMYoPs8dvGC5F4wBrtvHmtVIte-1hb141VhsXrtiSeRivUsnvBJxqYWnhjttPb162Z6rDMqin2BTpE-cl2FH_jSS1U5AjnLY1QamRgKpXHTS1iTUtfU3jhG0MehOrUYVbgsOyQGyG2eaMmN0rwoSIvxRuF36VspQRvOelFsZvv2R5SeBLttC31ozfb0RKgFPLnlY7HXh3gw2Ex_ZG6-K0Zyfgrl0jMv_vBMTFotrWprEmXf0PRUeMI_10uYjQoNrAxnLjNxxZYX5xkj6TcjzPTLOI-eeVogkVBBwU0uSnrSL6p9XpDb3DQ1KQELsBsP5Imj72zmfLCCTkn2H2Ymp9dSyC4li6rdnuC1vILgJlm4j6uWgjqzOWAuegGji0M9QMIGKk1o2h7G0e89AhmxYAdt9gWGxFcmxiDW2LLdJi6PF35ybywf7Oyhzof6Eh5e20y_Qix_TcMpk42kxt47va10c74y1a65PMIwBFIwFnn1IEVfwLM1NRUKApZkLTixn8w0Exu5pm_wt4p2dC8pRHK_KeSQM0HOZbXFwvo8TT973tiy9gvGHSE0x8iQ80OsFarzrLsXIlrh7BF1SjH68YOCOCd4K1eQWkb5pXyrXS6OOc9OYnQKjGN_9HEHkTQ6Q7wrZJmKz3bpRj3u7kzxrlIB9DeSP6rTGLFMaHVopulrtaOL1U351WGal4Lo3l-JUANBNXK8pzx9g9cIAN5A0XNpPXh7yvNRQWoc3Bneftuq5va-TAEF8BvxWqlMDu5ggADsdcsAyBOx4n4m570HpInRACYf-u5CPjC-aIq_XrvloNVxP9tEaBy9tdExW7blV6R78rnIsOEq_wPH2wI7OjlYc0m97RpvpiJo1-gJ7oxJKY0eQXBzERRYaJxwNJUVUfFK8BbmComPVDgJrY777lIk83ROglvP8rG5EkZlrDjflb5f5WabCX1BSQKD3u53I3J2MSvAymJrtZdRAQK3nTGjAZ6ZTa_xhAlRa1z7LojhVClnir9q7b35O-z7gJyBBaPlt3QeNOMSNRh46E7KqzRV_bmccqCTAgxWLN8lBwHHHf20fGIAzsErMKpcscOUPaPriDaEu_Ck1OBVM2OVhPqp6OdhQ-gPcBVg0GO8CtOoIf2--9Hh4C8xV620tj3uE_Ab36zkywE0bmE2f0TntiDspzjGRL6gmgrnafcKkhmcW7XWZi-K-7ybFQ6wmT0P4yEjwlV3o3YZHWX7XAHYKzAV4eAZIKxG00RMtVSOs6pd9Y2arkN-NIXjtsAbdPVqt0xWBZtFHW49ZS7oOSohF7H-dK0g6DZUba_9RWkGZ6hG2lvMeufexHcQcYQkxODxctnWZvpnCIIxYZ1GNI7iF9BxZktaXW3LAHs8aJSa9suW3hBkCGcKB1NidCHDVCaJaCOdUErKInR36tCUYLA4DAfGS5VZqsq_40svUkOpwV30FQX2WlCY7rUbCoMqJ5VLsPkgDscdPOpXxnvFwzWi-nvmBPNIJ-hV6pwKMl6YFwRhLz9_q3ttluDPvLhztElYf9PbeMT6u-fCdHeCTVe90JNGkGsrmUzdbSfESxRLECE0p8fmg3DMDgijES15_3VNcw-8YrReJ9jx5zDeYacKHiMpGwhrWxZabvhoHcXQDK1hp1nrL-qSeR8MQJazvqKNI4ZVn77Y2oHYOSlIKcNiBaYxiKvwhXn6iduaHJ74WqyWYIy20jgK5uZp1eOehS6MOYCLdsrmfSwMiXWJyNfkMFjrgE0lCK3R7FNWT3h5oZB0RSQ_YOfihJ4T0W-1VXxi4IVMsWgV-Uy_qOFerF9PXLnbqh5pGz9bvVtAL3uWCsm6v7SieHLHRqZL6bRkuNJ9xuPbuwVHV6VTteKKcfSM_wWZ3l4Xoa_JXsIYey96BFJ1tcyNqTOAzX5lo6nGuunjKs1yZFylBdaKA8g-S87tng3wXTi9eECNsW3RmvSpKsoE8nwuiuNG1y-yMc0WzkQRMNf04K0hoqqxO8sA1JyxYtrXO1AvxmRzFUaFqHozbXxzLmuG7US3ZN_IwVG_3G1iF1HxJ80Ds3963N0el04BRf4EC5Q2qy2wKS_CcyyObr7Kp_NIZIc78&cid=CAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=3207431186591130600&adk=3690638928&idt=85&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2961 41 KB
14 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDYwMDg0MAogIHNlcnZlcl9pcDogMTM1Mzg1MDM1CiAgcHJvY2Vzc19pZDogMTk2MzM5OTI4NAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 2961 0
505 B 48ms
40ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDYwMDg0MAogIHNlcnZlcl9pcDogMTM1Mzg1MDM1CiAgcHJvY2Vzc19pZDogMTk2MzM5OTI4NAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA0NTEyODg2OTM2Nzg0Njk1MDIxCmRlYnVnX2tleTogNDUzMDM5MjQ4NzgzMjA1MzEKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"45303924878320531","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"4512886936784695021"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 44B9 30 KB
11 KB 13ms
9ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AcE5mRsujIqV0VOJmvthyAgERBt0KoCsT3_upcQhC0riVQbH9kIHZvrfOMLPD8h-jNvyrAIuVlkfBERVxZ_zSYehzKnNjvoTAB-yp_aRGSvpxuKNvPMCIHP0MnwJUVHo9UMlROuuutroeQdY0iwOaFwgeporc5TTTlvXj50QQ3Op_hV_M&cry=1&dbm_d=AKAmf-BVbQ9bIfcU-smjLdWIT5zWk1-8OTM9KkbMayvWxGqsrIBoEP3wBqNFCnvH8PIo1tTfCEfhayYfQ5wLFntYcaJmyXZwAyG0r7jcnQb9PyTd-5wUEhk35KeJ_dJ7Oe2jtPJlubiQIktXJIjrWbWKYBHJyLhjjLCbj894c6FYRvDlq_yC1Iqif_IecQuPuSmfLqb6k-fnrFyjk4Xv_bmWpoa0mtXNi_d40i8B9miPz2TKVDAjSCsqiggqunej68yJPgaQ5mgTZROfTmFVvg6t6DFOmY8nhk1p3dA2_yv7nQW7Zp_6Fo03IA6Dukns5R-Y64aGKdEaQ5AFr_7fHJf1fdbfwypzMpiZvLEi4F5HLb3dRKeZOWCwZgIyQNVnFHUBPo4SVwP_Dlf1_mflYiMXo0yQAKK-CRXtK65CJjVYeYHPpk2zeSi2IUbg-rBSt82Ev0-rO6s0JOqKvZ-pnq66mSIjvp0jtrx2_B6VrKIS6QemFdDxy93l06Jof07zTVNlXINnbbcdiB2GMF_azNxACaIM94goXgh4OEmqA9pKyOmFcKJQ4MroUtGFG9kU0_Lb1g437LP1l9O17XvQhXGqnF4KuD865VzwEIzzz0ElEfeRyeBLjCYlLb09YejIwPFghcHrz54VC22Zhko0t8M8MMJdtpQtkL8IYbV9yDdCLFYfsHewXZ8xzsALvJia9InA-4QGb0PkQTZSiXn63mC0wHCQq89DXzcIksDl0XnyUbKyCdXvnLTjIr3PZaHrrOaYfarirq5cvJWoOzenlVs8XXVG1lT3YzTDtP0DeHNytcbXRNq5jVga4cWWBAQKugAy64KEOln7YiX0e47DYIxy097hFNTwTZq-wd_3S8_k1lxVUfuGpd2rlKf01KYznu1lLYp-72iiUGE4YqJCATjWon3OM_8MCMFtaFXtjBcFrQs9L9U0qBb3LPV-0bn98liYV7dkzWGODBNuoFok3GVRuH7Rx2OBtoZFreDgrrGbsoloZOGiDNyK2_h9OLhTKh_knDIwEPJEnjqAq5i9ICCBtdo_c20F5w2xgavuJjB859D0cPdNslMZ1iH_goYc8zOArk81Z21bDPvTXaP4AP0JkojS18qn7chC2iYwUxcRdwBNQB0pgkWqBjwDH7_NnXvO_GbReWWABzgJI9Xq_iFP4OeaWsyxxF7CI8luu63lq3P3Njzt1kfmH9ygxzKC8aBYSHogkBpTJrMP_ByX91SGFhQuho0PZWTcqEToRu2-4sQUZ-eaoNWATbAEEFjk_ENNjmxU2o3U9RmtBFxy-HTW3JBufmbneZyttw3vlJa1bpEm6LPGj63a5m1-9_sDfG3npEQnWyJ_dYbTrkocY0kMFc04-RleaWrp1vq4yuw8_rOazijxoSNPdwRcMYXGBTeA8POMNLg4RdHdJ7VvUibK8sx9bjIlxdcVLKLVEsBc8oNCdHf8xpKuD8_vKqMZKbsgHVL9jmkSh-1yVKx4rar10mJtcCVqIkz6UV1WkPd3FSxe84CPLMrELRiaOl1UHpA91Q4bxaLkyUGUS6tCuwe9b-jkR_eDRqxKdCobpPTXdOoV1Vhn8xs-IGsgSCqYZKKPgoov7pg3P0YcMjRQillySe-MEyKzY_6BSydLY9tu1l-XDiwgizq6x8v58F5rbvwGG0dw79hiwkmnI1iPr-Z0a7OEoAip-HPERNgHOv1Sso5-ozYpLUuGZLStehRAj-ywb96G43y5oCH3E13JgrjdgMa3SckF7nPLuU5Qf_oQo6_-XqkmJRQtsmHvkjFXoCNKOR7exfooo6ZBXwFCqAqnDIcL2RFN8cw2NT2ImhivM0PVL3FxEmOJ35-lJiSt0W8zZ0GsI5jSa-r0z9Zwos8TwujNMzGkZmnfdg9x57JWOb5RDWSKvx-sxvzy7ItNrf_bzPbzPdtEYq-YJVmzIJgeELVaXVWQj2wHQoN7acpMh1l5QnN2RErC5akQpKGl6ckUPkiVtl_uts3Qjy6thKgUvwnoRXTdzU_mp5bRbTP-elrPJee7K1F-87Nwag-RTGOwSooAW9uGo-JRRRuLQNG7TgRPV7PgXaFrEGhHMY8efQ615n6X6tlDbWYCIMmCoSalhTD4jeVpee6MbjukvK17Vb3XrQJzWbMbg2DKMVH4PZy1PXAbnZIqwhgiymCmMR4-DG0Rc7Q-WpWC6B-H1FVjFAnpAWuD48Gz6FOLYEyN4vthc9b6lQbw8MrLA_-K_xaS8B2UJJy0Mawnm8xlwivgqKq2gTe7koRRago3DuxgqxAPrnMLVR7I9nflLYuvx3bCajZk0sB_Vfx3V9NfFZQtK5WmKqtCQZ_KBuVnpiHkxoYYQ4wwEmp-yz6I6whh6TSG2P6LskkeNqqcP_5iJJia6CJW7qQp0z44MP-gJj7BowquNALImv8Wdo6zVTk3tesrj_iUM9Kq3_rSA_2aRiuIObgWWEUWdaHv1nC4yHgKTIWTVXCAdrRnBDOXGcJ-_rBsyedYKsMQoYpgzGhyC1gFd1tgI5FJpOYvvD_cnIc1hHiieF_a7DPMz3gAIuzZQpV__RkzT5banwbsu-wlBrD_LthWuRkjjciBqRbhUVWgCxeBB1ZLj7SBN2dxnujRMCSIvv-h8yB3GKBhy_uBjnkCPDK1_WZRkJr7ykG3ngtelEpYXfwwZGwHfWecS6aUiqlShuzjCsQVdSqQnZPhKhxi2c4MfTfyZrGm6iM_2MLw8SIho8SzvQV690ITn9MW78qsks9-N1Wc-B4sNHixw39WDRMfTh8d9hxU7xJl_GUxp9iwpuITRGWO9vTXT24ptO8cy0RZ6Ynmt4_fZJZlTNtPwJky7lTOT9Trd66AYoLbQbFhLREc0FdC6rW18_jCbjV7yqqRS520eCkg1T2JLAxk9q4VQ7oRcXj0ZUsTy9JfJ2HYXjqQ550o8vGn9rz_KQcKEQNPxL_aMwfx5fEvF-YjBZdQnKJ_H6a12tkoc06InDYicBvkrAt23nyNJ3_LSJ25J7A3Y5azO5nJJtl8FTl8SaWcnMNIQOr0U-ekKaeDA0I31RPx4pI9CNZCgCl28BTYLt5cN3iYGfTGZ360vxEdrifGIwCtuccJu_CaJbbsgKBByPJTGU1gnSPKBufKCyy-4cFmYjWqKn8Vo6V5duP_BQZQPHRs74Hid9XXfV7t22y0c1pWgNPrDugHAMRPtAHXbQrudxZ_mJ1O0jjW5ponlHqlY8WAYryBFSm6qddX3AGr0CUC9YdQSpH50jvJyQlCOdKpjIc8mQFmYseNt75GFaczwi2finnYXic5su0PeuvDI_2Pc-zTVIUOe8_UAxpQyPfz1aI2mwYq5Th4qkCrqjinN9Prdcxv0yzHxB61kYuRFK19wYjW-rgD4j2D95vFpaIK4_VV1H9LgduJqR2pCBRHKmXhDnlB3y35z4AiDgMiPqlxX_ifX8PwxlZ3PtcrJbLLLspfcc3H8kWwM5HO5FhKzql8TGTGkggT2B63XE2xwzptjeyCWHdvPoSuvfVi9FhVf7XYRBh-CofjfuCQxxJdiXI4nv0NU-FEt0uNsh69kBDf0klHX9pX_HRAIncmf88xdb4VeSfgXdQwctyZNkF2Ygno1B8wkYIMM4z4LU_l3V8qcg1zQgE4R8R82tQGFfqy-3tA-qet47VLwJT61GIvHLDFhiu5F6NAyi-jxBlBmqljQpcIrGa6RPX5fxRFKGOiVF2-wHMe1FaKg8sRs_Fnz1MhAVyCx-f1t9JCHiMLcsfdJwC28i_0Upp5zPuv9IZicJx5dM61K8KrxejzqqMq2Jn0DEznBYJPM5DPfxq6oxQfJQzgwOGH2MMVJoO4yMO7o210xsuDWR2UKaUpHbLEmV_t1CqGn-czNa1hrr9UfIsxnYdgMWaUZHLjB2FYjWJ5-w0aGienV59r8j-2yCM5JEXJ-1SYpQ7w4TW_a3NHXLyTXCs-Xi_NrlwhzEQySChJ-nedZKOZKvMqp-poZQgsa3MCj9PpUfwDHU6BADhbnsFtMMEPc1J_AUxTZ8rsau3PeBXTb5ocin6GMAJjKBSid2MVmwdAPenvgcH1M0NgItG4OkTxRMN7U1wP96ByrYtf_0resmiinIXf7v21IFzdVZ7wogOPNPZ3YzAaQ-hTsuiYsvl2mA5iiVaSziZVchEMG6ocd4AHxjBzea9h4SldMWp81L8Eh1q6wYknzAfyqEYTUO9KDM_7L7eFM5vEYCEreglv&cid=CAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=8290205236407341000&adk=4188270524&idt=65&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 44B9 41 KB
14 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDU5NzIwOQogIHNlcnZlcl9pcDogMTQ2NTMyMjA1CiAgcHJvY2Vzc19pZDogMjkwMzE0MTM0Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 44B9 0
504 B 47ms
41ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDU5NzIwOQogIHNlcnZlcl9pcDogMTQ2NTMyMjA1CiAgcHJvY2Vzc19pZDogMjkwMzE0MTM0Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMTQ4NzAyMjY1OTMwNjE0Mzk3MgpkZWJ1Z19rZXk6IDc3NDEwNjk3MTY1MTEyNzUxNDcKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyMzEzNzkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY1OTk1MDE0MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNjI0NQogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xe6842cc9601eefe0000000000000000","15":"0x1e4ebd6eb16c3230000000000000000"},"debug_key":"7741069716511275147","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"11487022659306143972"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9494 38 KB
13 KB 12ms
9ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame 57D8 59 KB
14 KB 553ms
34ms Script
application/javascript 54.217.43.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BofZx-z-vmUY_xT70NG4i43OhYf1kRjVTyv6H-S4rinpv9aOXgBwDq4GNeoIcceJw1vzqiMpEfV4MAfoEHt-ekw8SMmU7h6xP30cOdr4Vh-aPOE-V9juLLuUsmdF3ZjgzfavuJBpDSxtP7wpyxTf357Sx2y0sMzO1z3iqtp4WSaYuUJc6mtLXQZV13t5mKGd53nk1sL7IEJKnSktAhNYkSq9O_lwXbS4N2R4fLBq1nmmQYfrk&dbm_d=AKAmf-AS2VEsn5GLKLGf5KJSBS61QDEcaYygrrDXQKb5epvBREgeqAdqsn2k_ullC34xBjKimCoi38BT-x3oqpXin5xHw3Z_o2tNhgBduqkynnTehm6WO2gj9skIEF6oZV8H-uplI_1hWaZsOOfSkvVt_-ikTsustkZXHg4OJ6g0Y3VpS1Knphj4Stj1qRwbMjP84bKmAxzdhxVKa6af0e-CfzMi9uyJzkjjPZPhYIHCcPt054Mtescubpwy4s5_VnzUbEg7yQBUf5hTDe1vIQBwruRYX2kG6xnR46bIGMhJdMvY_Ri5dKIzahwZrVMLOvByRZLJX-VlBNWv67SRRBmk1ocnmg43IWvQ8f7H76Sggdece17KW8-GIo12JSTmHOpRNq3qya7cUARP2WA2OWMjBvbKIVdJ2TR2qpNrDkZy_Pzim8GemSn3MNfn-5iFpZM9gezzryLnbfwh3MtTj1VYTz5kzHgOPc3NP_HSs999x9u6qNDEDiTiraYHnUpKHzNITKBYzB5cT4dQCU9IgRUn39O-U5mrEO2fQNmqnBlBv_-y891uLlCLdHFTzC0eqaB8F6GCsO6tLou7ft1csLPkNGShOG8Wpg2fqG4fsvsUJDIcR68mH0OafwtsK1GqSbF5MLSbW5v3-K7sI39q1UnLDMfDYAnK0XRkp5IPUatUnnt8n4HBBuJe7CqaQp2g_mlOO7bFIOZCNaHi_xqGp0Lnh8-TW6PS4EC1rmAlf2yiyQ-qdTXWzeqvXkUrSAgI5qQj1I9SAMTIh5ZRnntwIhaxPPO2JRo4qno75_efTOujhESXujPUCYoPHxidQD4lTkYPRT_cZ0xh0KmqmCVbZlxSKqrtuwR8C2zq2n8IAW9F7MEbdRDuaIQ6HqwNm_HNPkId2VaiiOiXSGylgoCB4mnWT8s6Bakkm5vaSMILX0OoD0TQV5GvLQyzQtgmlMpt_hrdaXytctw8N_2ch_aGaqiRSzK_kVnAFg0WbRc1_TRIJWve-gXGo8M8kqZedX3T-j7aYg8_71qnJc82ifgBUBoIqdJNeDWlp2qRmFineXL31dttY6BFTl76TpypbNdFjCd798wNKqZoBaICkExSRS4lBGMJlMLXDX9r8AYs6XkxWKGUDQJAHk80hg7P_arITbYL25VI4B3A-PvS2wiDkr9cudclJiU4kNMPMhjwKuyh706ITNl7ThsDaUm933VzU1XKysAJcY9V9YmFGe_SA0l4hRPPq4XSB6gJ5zFCExAjdi3RMPhVzh4aNHNXLBOVRRyFGV_an1cVTbO6_derPReUdjaXAPJn9G7uiW44MHaH7GlCnkwd-NvwTQhmwMVci31Yt5jv9V6K8dtoxBCwOx9CSl2T7p6f1EuaIeM1IamQTzhUAfZnfbvPg7BtW-BxnGHZoe5TvwLhGnWWG2b066LQURzr7KMjdCz-j5N6HyRd7J4AMCsMuxKwJtuUi3oqYAz3OPJcb6bWQJq30smPWmlRszg8oKgL0wC5drB-Nionz5rlU05QlYz4CJ2iE_EnMs__Ge19W6tc-sWa4oNoZoj3RTidN-q4ER2ZOmc8vavK-70UIIL-yfe7gqH8cDjK356VG0y0pQEmZ1oOLMZro5IzAr8DLLQN6CRj-rRHDqr80RUgvgPbGK4oj0Mk1dygqMhWuoYCeQjkUmnactPExBF5VR7QyWaBUVH7gB55dhZfsN-A1bueKMRfHPLVh5fxQrnbFqCgHg6cskxhGaroYlp4rVjWJLBpXFS0uBpYmIdUpa1m-OJUHFUn-Xn_Okn1pTjTkHKBvOri2bwrZyhitKeUT-FF1y2OiOZjOpACU_LYXPtUq7IOr3hFSOvuZjsfdGBIxVxjobqmgj-CCMHx04jjaJmLoDldiSTN-mPyD2v-CYT7JnEhUPi_r_BKOTcuUcbzzPd5GGLBw9E3zJu6I5wVAS_1GzFc9kK7UKDd_wUJOi4hxIbPr6A0OWEOAwKmFL-QYaj97O7d0V8IcpWpN8kD9nuXZuiawXbCpCWmJqdBLAOp8AEqTVA_0aHS05PzQoRC1UL4mH2JYJ7JFKFfTyLmlSRTLiaPJ4Nu0iB0anmQR4J3O12tExecbbx9I_pMThfHQBw9r6Az3WhprRblgzV6jxK5wlaDA7Dtkf9krW9wpnDDvr0Lt8M3aYFzh79y6KVfa0yOPLzrIPXEfP0Q_9IoDdRvggzWL-hGc5QmY6m5fTVAmQCwFXzECGauah23aEt1vOtLYQE5MzRLSf9MKGKr8dL8mzqRChN60bRX2wEDSA3Gx7Z2j8u7WotpAzMC7kzOL0MlHkqRl4Ket9eHK_oYUYuG13V587sNF8h7wxFiqsGKxTGRwJUsKMM9-aLerxa5k4fH6cWhF8xBcGyySjOXygdcOoNfQSzn0X3OMIBPHJW2ks6uJtZ26QFXqRBh5VXu9Gf7qTGHTp7y-zxUokwZbiXEE1bjrMlW0_DV9ayvGh5VI4pW2BtOLt7hVam3f4Pw6Fcb6trlSdIyg70OUyAAcCWn1FB3ck7X06wXlFFKDQ7-ZAhUcPgPIMuo5VAaDjPWloiGyOutipZRckWkmMtW4iS8_kaXRnYqNr9-t7zkcNs1l99yYgcb7kutJ2po1KyMd8hnYViUjvQ29Kpjy08TDgHPeloeqWvE78QTPTJBJbjhBKTeNY4a7hG5qiwsI84u7TQgd9m4QNAA8kieIWJ8ZjWx8Ruw2DAdAVBXr1WClQs0n2FJoO-j5k32l9G2RuwL9KzfuH8AxBQNN41nhN1suCSnAcREFaQRSVYr5Oj_I1MWMApf1QbNieInAuLv5gQVElM8JI-Qmmb_MyaNzasE4esaSfvOw82zk8yEYP-Q9vhU34ejB8KMvH0dlmyPx51HZTnQK1hVRL2jFjNQ4MyXkqEfpjQiGEoG_X-_bt0HSfL8V1PcSFr3gW2y7nky260ftx5SjeOJ3acD4hCpu-PHT-MWJ7-G221vJRDHnNPkthtOzdfb_40s9u35JXDzXaRfZIhp0jczd7ZmnkFCys8LdxffVtXh9Drgqq5OwvM5H0sDTUkcgYJuHhhx1ru6WYyzyFMJ5oSu2mbakVBajzNAI7P5B4IToiNtjJoQcIrymPBS856nBC1cIf8vrsmoYxNkXowNrw9YxNlAo2JQ5bgyST3SaeysK_OmsGHz7f0Pm3lS0xIN_yUS0NP07cWjMlWZlZpqooddGDQu_pI3NWmCqOrBnFtyevT1EdWu8ACDHJ_nnUU_JwNiet0qSZgvUd5RGAGLo86eOUgaLl0gzymAVTvp_WZ9M7UzhKgl3-kZlWRmwHQBcFnXIhpSpxs5N2e41OHtUAwQtIpdC9IKrV0fihsbk7s4Opb3yg49pziac1iB_hQyrqP_UrgzJMjz7Tvoa9PKESQ_LZcRnKJR99FbuIJ2e0defsNmh7T7izroQ6_bBuD4gb6vqOhyl7C2Mt9gIzMX641j8LEcX5l50a3vjV-pxk7nvDaBg6vWoi3VIwLYB7ncemuRb21-D6N4oJ9OT-1In_KdV84O2pmhiGPEWi_BK2x2Ds6rj2QTe1ZaRfrSsDqXZaIeTLVMp_xbP_5k9Sg8C4fXnWMSKNv34JtK_FthAGzPz_gmMHppO03iGOxjGf26TFNcPi0vlaqOUp3GfrZ7Av3BuFzXhf6kWaBVTbQwwdUS9E5sz1qXbdaGHoc5C1fgaoM73ef1UfSvPSQKda6R58UrD6hfsP9GtYhlAmnHGzrpu90DAH2LM6fJ5U2aYaUQ2fgXHgy79hSMRmM1cVZsdiXe8lM31q9SAK5RwJdTKSjWkEUIhqkUaVWL-A41zsx0nnJs7JM42HSA2h2oLAVLjI94uGQBOSxuxJGCnR0Zq97jch76j4J9VVQo2pgl1Rqz5jGkKeMl37K5mKG98WmbPwO1nelR4KlDUm2OZokMboyTJdo3oZUVTX47pBBrKNvf1xhQYdzfCiVULnyg-RS-IqPfflwtjtRgjeZRmXdg3S7ntl0p9aqOhpJoI_wWH7XvrH6QiMYWmXFzXf9rQfaMxCZyMOzBehiM7lzfI_LRM-nOZnGZX7UYDQCWWg0GCC2PGD9YvBPsvSyinkv0DRfE5Ojb&cid=CAQSTwAvHhf_sgu-PKiVcDxO10wUBldXXd5JKHIEj3LEPIFY-SMVssQwil0OOX7FID1bdWKlqMQQyMXBTRMTYUMixhTO1Vz3KuSMx8ZmwYYU2wgYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=1953100035993765600&adk=2923430906&idt=62&cac=0&dtd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.43.2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-43-2.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f7ce85fd70dd9c77ccc7547f798b0f5be5b800225f40d15d34b95320b9642771

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame 57D8 54 KB
54 KB 13ms
12ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BofZx-z-vmUY_xT70NG4i43OhYf1kRjVTyv6H-S4rinpv9aOXgBwDq4GNeoIcceJw1vzqiMpEfV4MAfoEHt-ekw8SMmU7h6xP30cOdr4Vh-aPOE-V9juLLuUsmdF3ZjgzfavuJBpDSxtP7wpyxTf357Sx2y0sMzO1z3iqtp4WSaYuUJc6mtLXQZV13t5mKGd53nk1sL7IEJKnSktAhNYkSq9O_lwXbS4N2R4fLBq1nmmQYfrk&dbm_d=AKAmf-AS2VEsn5GLKLGf5KJSBS61QDEcaYygrrDXQKb5epvBREgeqAdqsn2k_ullC34xBjKimCoi38BT-x3oqpXin5xHw3Z_o2tNhgBduqkynnTehm6WO2gj9skIEF6oZV8H-uplI_1hWaZsOOfSkvVt_-ikTsustkZXHg4OJ6g0Y3VpS1Knphj4Stj1qRwbMjP84bKmAxzdhxVKa6af0e-CfzMi9uyJzkjjPZPhYIHCcPt054Mtescubpwy4s5_VnzUbEg7yQBUf5hTDe1vIQBwruRYX2kG6xnR46bIGMhJdMvY_Ri5dKIzahwZrVMLOvByRZLJX-VlBNWv67SRRBmk1ocnmg43IWvQ8f7H76Sggdece17KW8-GIo12JSTmHOpRNq3qya7cUARP2WA2OWMjBvbKIVdJ2TR2qpNrDkZy_Pzim8GemSn3MNfn-5iFpZM9gezzryLnbfwh3MtTj1VYTz5kzHgOPc3NP_HSs999x9u6qNDEDiTiraYHnUpKHzNITKBYzB5cT4dQCU9IgRUn39O-U5mrEO2fQNmqnBlBv_-y891uLlCLdHFTzC0eqaB8F6GCsO6tLou7ft1csLPkNGShOG8Wpg2fqG4fsvsUJDIcR68mH0OafwtsK1GqSbF5MLSbW5v3-K7sI39q1UnLDMfDYAnK0XRkp5IPUatUnnt8n4HBBuJe7CqaQp2g_mlOO7bFIOZCNaHi_xqGp0Lnh8-TW6PS4EC1rmAlf2yiyQ-qdTXWzeqvXkUrSAgI5qQj1I9SAMTIh5ZRnntwIhaxPPO2JRo4qno75_efTOujhESXujPUCYoPHxidQD4lTkYPRT_cZ0xh0KmqmCVbZlxSKqrtuwR8C2zq2n8IAW9F7MEbdRDuaIQ6HqwNm_HNPkId2VaiiOiXSGylgoCB4mnWT8s6Bakkm5vaSMILX0OoD0TQV5GvLQyzQtgmlMpt_hrdaXytctw8N_2ch_aGaqiRSzK_kVnAFg0WbRc1_TRIJWve-gXGo8M8kqZedX3T-j7aYg8_71qnJc82ifgBUBoIqdJNeDWlp2qRmFineXL31dttY6BFTl76TpypbNdFjCd798wNKqZoBaICkExSRS4lBGMJlMLXDX9r8AYs6XkxWKGUDQJAHk80hg7P_arITbYL25VI4B3A-PvS2wiDkr9cudclJiU4kNMPMhjwKuyh706ITNl7ThsDaUm933VzU1XKysAJcY9V9YmFGe_SA0l4hRPPq4XSB6gJ5zFCExAjdi3RMPhVzh4aNHNXLBOVRRyFGV_an1cVTbO6_derPReUdjaXAPJn9G7uiW44MHaH7GlCnkwd-NvwTQhmwMVci31Yt5jv9V6K8dtoxBCwOx9CSl2T7p6f1EuaIeM1IamQTzhUAfZnfbvPg7BtW-BxnGHZoe5TvwLhGnWWG2b066LQURzr7KMjdCz-j5N6HyRd7J4AMCsMuxKwJtuUi3oqYAz3OPJcb6bWQJq30smPWmlRszg8oKgL0wC5drB-Nionz5rlU05QlYz4CJ2iE_EnMs__Ge19W6tc-sWa4oNoZoj3RTidN-q4ER2ZOmc8vavK-70UIIL-yfe7gqH8cDjK356VG0y0pQEmZ1oOLMZro5IzAr8DLLQN6CRj-rRHDqr80RUgvgPbGK4oj0Mk1dygqMhWuoYCeQjkUmnactPExBF5VR7QyWaBUVH7gB55dhZfsN-A1bueKMRfHPLVh5fxQrnbFqCgHg6cskxhGaroYlp4rVjWJLBpXFS0uBpYmIdUpa1m-OJUHFUn-Xn_Okn1pTjTkHKBvOri2bwrZyhitKeUT-FF1y2OiOZjOpACU_LYXPtUq7IOr3hFSOvuZjsfdGBIxVxjobqmgj-CCMHx04jjaJmLoDldiSTN-mPyD2v-CYT7JnEhUPi_r_BKOTcuUcbzzPd5GGLBw9E3zJu6I5wVAS_1GzFc9kK7UKDd_wUJOi4hxIbPr6A0OWEOAwKmFL-QYaj97O7d0V8IcpWpN8kD9nuXZuiawXbCpCWmJqdBLAOp8AEqTVA_0aHS05PzQoRC1UL4mH2JYJ7JFKFfTyLmlSRTLiaPJ4Nu0iB0anmQR4J3O12tExecbbx9I_pMThfHQBw9r6Az3WhprRblgzV6jxK5wlaDA7Dtkf9krW9wpnDDvr0Lt8M3aYFzh79y6KVfa0yOPLzrIPXEfP0Q_9IoDdRvggzWL-hGc5QmY6m5fTVAmQCwFXzECGauah23aEt1vOtLYQE5MzRLSf9MKGKr8dL8mzqRChN60bRX2wEDSA3Gx7Z2j8u7WotpAzMC7kzOL0MlHkqRl4Ket9eHK_oYUYuG13V587sNF8h7wxFiqsGKxTGRwJUsKMM9-aLerxa5k4fH6cWhF8xBcGyySjOXygdcOoNfQSzn0X3OMIBPHJW2ks6uJtZ26QFXqRBh5VXu9Gf7qTGHTp7y-zxUokwZbiXEE1bjrMlW0_DV9ayvGh5VI4pW2BtOLt7hVam3f4Pw6Fcb6trlSdIyg70OUyAAcCWn1FB3ck7X06wXlFFKDQ7-ZAhUcPgPIMuo5VAaDjPWloiGyOutipZRckWkmMtW4iS8_kaXRnYqNr9-t7zkcNs1l99yYgcb7kutJ2po1KyMd8hnYViUjvQ29Kpjy08TDgHPeloeqWvE78QTPTJBJbjhBKTeNY4a7hG5qiwsI84u7TQgd9m4QNAA8kieIWJ8ZjWx8Ruw2DAdAVBXr1WClQs0n2FJoO-j5k32l9G2RuwL9KzfuH8AxBQNN41nhN1suCSnAcREFaQRSVYr5Oj_I1MWMApf1QbNieInAuLv5gQVElM8JI-Qmmb_MyaNzasE4esaSfvOw82zk8yEYP-Q9vhU34ejB8KMvH0dlmyPx51HZTnQK1hVRL2jFjNQ4MyXkqEfpjQiGEoG_X-_bt0HSfL8V1PcSFr3gW2y7nky260ftx5SjeOJ3acD4hCpu-PHT-MWJ7-G221vJRDHnNPkthtOzdfb_40s9u35JXDzXaRfZIhp0jczd7ZmnkFCys8LdxffVtXh9Drgqq5OwvM5H0sDTUkcgYJuHhhx1ru6WYyzyFMJ5oSu2mbakVBajzNAI7P5B4IToiNtjJoQcIrymPBS856nBC1cIf8vrsmoYxNkXowNrw9YxNlAo2JQ5bgyST3SaeysK_OmsGHz7f0Pm3lS0xIN_yUS0NP07cWjMlWZlZpqooddGDQu_pI3NWmCqOrBnFtyevT1EdWu8ACDHJ_nnUU_JwNiet0qSZgvUd5RGAGLo86eOUgaLl0gzymAVTvp_WZ9M7UzhKgl3-kZlWRmwHQBcFnXIhpSpxs5N2e41OHtUAwQtIpdC9IKrV0fihsbk7s4Opb3yg49pziac1iB_hQyrqP_UrgzJMjz7Tvoa9PKESQ_LZcRnKJR99FbuIJ2e0defsNmh7T7izroQ6_bBuD4gb6vqOhyl7C2Mt9gIzMX641j8LEcX5l50a3vjV-pxk7nvDaBg6vWoi3VIwLYB7ncemuRb21-D6N4oJ9OT-1In_KdV84O2pmhiGPEWi_BK2x2Ds6rj2QTe1ZaRfrSsDqXZaIeTLVMp_xbP_5k9Sg8C4fXnWMSKNv34JtK_FthAGzPz_gmMHppO03iGOxjGf26TFNcPi0vlaqOUp3GfrZ7Av3BuFzXhf6kWaBVTbQwwdUS9E5sz1qXbdaGHoc5C1fgaoM73ef1UfSvPSQKda6R58UrD6hfsP9GtYhlAmnHGzrpu90DAH2LM6fJ5U2aYaUQ2fgXHgy79hSMRmM1cVZsdiXe8lM31q9SAK5RwJdTKSjWkEUIhqkUaVWL-A41zsx0nnJs7JM42HSA2h2oLAVLjI94uGQBOSxuxJGCnR0Zq97jch76j4J9VVQo2pgl1Rqz5jGkKeMl37K5mKG98WmbPwO1nelR4KlDUm2OZokMboyTJdo3oZUVTX47pBBrKNvf1xhQYdzfCiVULnyg-RS-IqPfflwtjtRgjeZRmXdg3S7ntl0p9aqOhpJoI_wWH7XvrH6QiMYWmXFzXf9rQfaMxCZyMOzBehiM7lzfI_LRM-nOZnGZX7UYDQCWWg0GCC2PGD9YvBPsvSyinkv0DRfE5Ojb&cid=CAQSTwAvHhf_sgu-PKiVcDxO10wUBldXXd5JKHIEj3LEPIFY-SMVssQwil0OOX7FID1bdWKlqMQQyMXBTRMTYUMixhTO1Vz3KuSMx8ZmwYYU2wgYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=1953100035993765600&adk=2923430906&idt=62&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 330438
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 57D8 30 KB
11 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 57D8 12 KB
4 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86024
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:38:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 57D8 0
0 50ms
50ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvP7h1kmcpjk2sv38LPExHzeBegRxw3HA82L0Hk1Jg3JbtyOQwl6XpPc1Cj9lXzIModIM0057wf9a6MOoE0WULgBg3PzNWlu-cZYxnG7NijxGGEtrQsfHa5LuiDSOwcfpsSzL54RdZ6zAzi7SxnyZNmyP_SSFXxGaBNsQEFXWrODCWr42lFlDsCRLCxCkESfi49IB3YbR2ZDpW2UlQ30zbmajs42jr7yeCoE-LidrQoGiFYDTRIXgWF92pWJcVdeqJ2otVQd0gcL7ttH_vz2XHVYQni52VGv9WN-LHrE7W-NuGhXlOsy189t5IediSXuhDlmgfsiqdUMQ5Z3RNbOSyKu4xFnUuylOl1Hi0m_Kdt05YCEQt32HV-lB_8L1FxHjwpi1bEKgslkx_BqaWcwwqyRso-j89SzV8JXW1jCe7dgEz7kBxr9MDDmrpbFlxpn7LuK2rvElMVE-8LH4jO0FCBieiE4ftEHMPm6OkuCiH5F5FkpVNyZXr2fNFWOT72NpwhDsAeAvOpurRD8BL11_QDyi33nX90aS-EH3xFzQ0_kY-Ng9dsR8dNLIxe1onphJcBTOIPASW63UO5x6qJD1LHxPozm2RTM6iTS9xm-YZ5vztz4_nFJGiA8M92ZZOng8MPMEbIei0IYtlg5ofNUUIYM-NbslI-cz5UkGhkExvvXcKJNZLKgOWYn0DAKthv_8nmsyea-yGCwSHWgpnbPiUuQ2mQy2oq9EHDKtXwcU-lZl7ASkW7ZORFezRR99f686H9N4CjVWc8LN0Ir5PLlKYHaz57c9SBez-4FxJ2lThqbvrvEFKt3pPEBDV8bX8Oq8Ua9_vUGE7cZn2kjM39VCDQcR7kuG5xn0TMbs4rMG4UzxqVyAe7IUv8WUcHrBHyis790Wtgk3i8sqS8Pe-LYlNx-HyfgTgToit6fORUL3gaN_HMafuFbNzGMOsorOKHsxwOFbq69qaUH-7qip9k5PfeOv1FLrnrkrOmGb0i_9APPW5Yt9sKSmoBv2QsgHM2YsnDLQiyR1LkKGuYw1uOetV66TKJlZ3Ezvtt6EX3g0PSJTTIiEM88PhUky4eGj4zE39MlYVRzhAxmF1FueO0yu8XNM0BoddMXXAkVVlSC-3LrkftZCwRszVfqDAREFWmk0G_wkcYBa0zzF2UdjI6JgHMOUyuvd7rDl0xHAUfJp5Q8dshBK-W-nIA0DUTWOMOB9wtQ-sKaDp7SQpSs1MtjYlmcXUJezu1NVJCyPNK13QGLUrywFi-a4bOX-mnuod7MIiLdQDZM1vhLYvgfMY-iBBlTXcmlnYXB0VMoLjuK48-GeXNzhxAp6dVup8Fj52px4wsCAXpGAVeC9e1i6h3X9gzVhW0ofK7l_xzXyMn-Ywe1oF5KaP1DnELnZQ4W61QU20UqpPTJz1KnUVOV4qq70Uag1Le5s5mw3tZh9Om5kq1TsIz_hgj8YecM7ypY6nC-9ilUacTJuUUJvVCG10wqnSxS3b7NxQGhBfoDg&sai=AMfl-YRBLHNRrX5n0b6vMFfH_jkRPEmPmvHufiLc5kaulqzkTFvZ6_zAKdxCVHUK0bmZAEPzS8RWLKis0LCHfidsOKuC8W-OIoEyVRe5cnBXlha7LmNpO1Q5jBwdkIgBefYAa5ONKnZH69AFZaonBsdetJLfVyKbu5HPEJVJ5cnAduZD4mJtqOJT01OCcZtah1iBn_KPQ5A0BK9vI5Ur1NggFuwgqtH2cZ6ef97g89C9_mj6LHlumqjOcsjeYdRYvSrtlPrfsVw31eA2ML1vYWCt7QEg5JdIo54eXTtIeWyyM2fGauA5BhVGfbnXNhnnKd8UNmhV&sig=Cg0ArKJSzDn7ZYQ7w10XEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240214.84849&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 57D8 41 KB
14 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
DATA 200
OK truncated
/ Frame 9C3E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 595311ad155ee282ad91d194b814d7213d36453cfaf862038dd37c3a84c8f3f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1712834/75654858/ Frame 7B44 272 KB
79 KB 613ms
118ms Script
application/javascript 54.217.43.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1712834/75654858/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013453133&ias_pubId=pub-9323971679203656&ias_chanId=1&ias_placementId=20921000617&bidurl=https://csgowfire.ru/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0iYUvgF72sErtJQeP04LSPT
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.43.2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-43-2.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 89d224402fbdb62152de3bc988c9431998cf9b28ad0a9ff64d3b0ebbdb0b04bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7B44 111 KB
39 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 20:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 20:43:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 7B44 12 KB
4 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bf6ZOCKK9Q1emuRJYTw8v4ymN5UJ2BrbdckcAxmFTOMMinjslibA8RtSg1Fsu1hKY9shUcYkBg_jhBP_4o0qsUOiH1C3yZj8qtd_ETDSfnr41UJmx4ZhX5L8qscx4fCmGoDp4WxHA2YKa4_An4TgAwwOTc-gAQuQ22kGT_SWKKp3eymHk&dbm_d=AKAmf-AvAEjAZCajk9zOckMdLrB_Ebv7VfpXO6v0DMl19BBoKKUwqRteFb-lT7qsM3pY-llrRp06uqwPjuXT4pG9fRFpVjOUdTJ7SRH0Js7v8nZIBGYzfHjBFUC0OsL5oicAqb3Uf97iMb8TOi9b4WtcH_knLR3giJTZQwE5gDkfDo36Nf0xa2MntcJCdLir_E4BKMQ9jEd4KhuZjilaJI6CmekoLfkrOHBXySLFf8gF8YHzDSYVPSzhxSO_Y-BUtX9W_OPWeTe0dGB5AgxTRKrkmNHgpK0cq06t9RRBP4Go01XJqj__KBRuHCpR-xyfMdDg9BqAdR8Glj8Z7Dv3iAI7dhSbVtCYw2cwiCnqifoJReWVpVO9qXd6fWeMV0_KQTMMdFvCDW1D_fvE4tMLwzmmpCmDa35Wx3lLqsZy2V7CKkZqESOOKnKHmktjM60Ax68JGwcwLmNNsDrWueYjX1RNc9c1Db9aVACW5JDEbk6EsnoPZ-ujAmjrh3bCJBuOPHJL4Wtf9iJLzsBTD_PzI8tAR4-iBh2ed1xhWNmkFpxuL3QdLr2FVJ-4Zi34269uh-yfc3j3KoSoC7LGcTn1BTFS5efJ2TvKkNYqLWlRKai4tTkiejJMv6rrI9pQwjr3CVs-T1qaqb0QZM7SSxz1CcWCuJ659PNAzBcZKDdK92qT_H4wDcJZ3icfBpYmdgXbpXJvWn2EHazv4iydqIkzNKLX1npGeCr-yYHSwdXeE2olWDMU7hv5nJu7q6HsNzrZB1NwnI4mJFzqPit9l9LWm1L0SQ4yBvI7PdvhK0Gh8d5IzQmmdq0pjI63RtCx-Otyom_iLvSW9AbogVbLcDvIJDBCe4IttAs65wiMgBM045KGPkFjWUJa5jY0DehvbgdScybPxn5vnWn7YUduY_F138hF5o9feEHzoFnMMJePB9V5DMepj3CaLk4kcnyoq17iigw-pTggei7Co2F5SYz_fD91Txmg70P5G19RLOHWrToBfOIDa2wwUmJeqZoLVNQy65ntoBGeCL5SmhHUCFURr1fROoAQZSDszlZSjvq6xlqkaS0fG1vRUfkT-drPoo1fArX5oiMbbBS8W68hIWZZCNvtEdWaWFPJ9zdK62AYzBLjpB3JjbH7r9bo4gl7W6myCYCooCPeIfRJlx5za6OLcCxeDTVXLmllv5GS3guW98LKbuXtkEDZcvhBMrjvt_TCrOcLcS3pnElEbm66Sp-gxZesXc0nVN51bNEn0oZ7wmKotHdoNkXbt-CBHLCpnXgfSvlp4cUmbNqVMABVUkQA3eX8Y4LDRDZyYP1fP1MSP_xnq6YopfjlMOxW1C9_JdTkK1DymxptiT0RZL362aKTY5YjkdlXWae2mIiEoQoFLV20L5DsFf62mJYo4wQpEGu1bu2Xn35401kTsCmM6erhBO4J5fmAziRU2YImYuEFbI66QR0BRPGEbMsWXb99FJ7WDpBtUgnrHRtrNSe9TZpBxz7O7ZZH3oWRQ5ym4u0z_Zl3Bm5-zdXRokp1BP6SeylDEdqbheTheUr3DMk8Y7hiNg2chpMZkOnjO1Cxk-1Gzg76Eohs4qf_guzfpUci4z_gl_OvFjpPVV4rqx7pDnOIOHhdrFa-VeC-QC0SAMGbju5eHez7Vr9mSYNSqp1QBRywcQdMiYEZOuJXxH8cX8SX_ZdJwQlZL_cMJSqmcfdmUi0GcWG0U5KDcu9XJgl9q0sjgLI83c7HXO30PeTSnNTY0CXcDoJUUazGkIVKkZNHrMVh-8zZWqMmcnKKkoI8SqYPccgFr2YDtngpaHmfjsnHJCQO7hqu1IOIIguOlv21CDBsfDcdU4fFshH4936vbQAtj3brEntm7k6ZaX7N_mfpYWwvvSvIVHHV1yKGBwfBWJ5tXu1xLdHeLoAN71H9F_SnzSBIdr3pN2qCQu59nnXQYX5uVZIJsxkNKwkSZi27qEMpxY1nSoAsgG_LPMPcXhQsozzq62_BAnyvZiyHcD_uHMXG7OLl1OvM3YyyQHoCZ0WeL_nmk6_i5vXlrXf_xi2F3H11pxStTLkURbsLRd40uO0ZSA1klu9SLotW4-2efO-yPKoZRC9x3VDkUccXc905iMGy3UsWm9FjGm6c8wrEdsYeWPLBzcYAJb7eqb2eP4nn5SuylEn0F_8oss4aOv6dMF2832gzITvv3hMo_SJL2gLdnBkq1bJ1OQjUNAeTmwCayldJxzweGAtcb4VSauwdM_YiLLphHPlFLYUbwaaQZbN5_7g51y2kYMqSin6L8_H_Iv6Pl9Dt6e_Vj31TfCDGbT_810ycfc8AFKyMdAhdFmkk4I85oAoyy-ZEZz0wotTreo0FNs3llkL4eEnXoPQQV9T4v_wLbnfXFWlK00n4I50SfdqNTOYh9PkeYvkkCOsSmu-N9bY2fAMoAlrsTqN152I8JbS7SBips4-f4rgC0-6aKHscRIAUxBaYn1KRXrk3S-QaiCd3qvx1OuX1iefz4G6-JK-rAd4rJYD8K1gy5Xw3s0X6D2dXO5EDxJT-wOU52I8NuMm8TlVLZDz6G16rQjw0GSvMySqgqkT0NztTJlBPbzIT_ndF4Vu7c01Ko3CXf49mE_v385ob-Zc_I087cgbjXomtvLJPsw5Ql012gZQ4wzFvcyovtB-4a--wZIaU7Qyh9ZJUOt0A6vUe3yR5J_rQbyIGLG812VvatW9FhRLx1V5kr60wokuKc8gZTct8GJacvOuUApQAXdsDLbuvADRiP0eTLZU_-k_9sLMnQKUFI8MXqcNlcXieGpinJaZqnqBZ4Qq-hDOywvqmel4REwn_CFeC1lKzPkK9UqcQnLVk-1E3p5odkrZuPmBkXj-yO9wtZCH6gvBwv3N80EO8lH7WwPTU5Fvmoh2DVLsf0iovps_cNhXDugxw7LCn4u4_5mvbLBm6QpePstlqbpCtpypKWq4gzKcpRgDFGrNH02SvKK7R4_1I3vPfa4pZbk7Eb2P2Sgku1YMYOQC53Tc5oA35ll0CfxKQEF-48aDS8IBHh-jqnOj0TrMNRBFNb-JZzRMuI63rb8NvtnFqzfirz-yPc29PNGfVhCXVr6Ljf4vzRXyePj4Yx6wa9d70tEknso4fNDc-5U80R6aCX3SCQrn9SfXrr9wg0i0eTFA4O9Wvc2FbHt2KOYNyuexaX8nxpr92CYaWiAyrqw8_KaJVeP8lY5XIhsUOxiGvaghV8lLznj1MZdc07ZGutFexlOavDMHEygzBQcn-DLao1HSzanMN5SC9el7hhhnLG4VvWjosR7cHfO1kf17B1aeEhnVGS-N3_IGae9leCscPOxjr0YwXxllNrcEwBW76BGv4nsFtzpzbflTMFPf3OREHeMSvxSETFu-MdFo14aSOEbeY51FpGJuNs49mYH-OGevGxSqxW6pKK4Wnw8E4Zhr3nrJeFZTf5keiYjdEdDiqTOkCxIP-tzUwrQy8riZPZD4JjMLDyxYSJGP5HGMC57zpKUTooN1AUea_hpvP0fEzzrUvRzLNgtTSeflOIVOcN4nsPfvGfG2QHK_IUYCoignWECgqVbY5UfkmJhwV7Zg9YxpHKHqs_aFerjJhAETDHetCOYOuuan2iQdulGD-9vc26_eb8_Xx_vQD4Gx1-Q_gDj3Lc5ix6qFAOgL65_PvE5ZSOc_f3U6jFa1WpuibUA5onje8ke4QqyexgYfIAJVkPVWOwWgxBLBst1V14d6KsJDruYUWHP3o-4zhBszbP6heArYaHr51cHhF6_gmoG-aNoKuhBq9yL1Z7VqLLOnQOdo2El8f36ZyLi8pL4jvBMhmjDLKm5sTkuaKTxxpdTCxpXccTd1ZUluTe0KQLie8QaPyb94OSFV0mD1xNQ0IFKvq0wyKFefYBr5FwyZcLLay4T-gQ9qfj-Pf6D7nM0fZP2BnrG4tSy4SPB7F3rUFo9FO-ncdoyN8qcLaun4fvIzeyzxnjzYrURhgkmYgrcJjsqBlWVk_BfpuIa19fufAocyZPK662eVxoxI-lzhXbvGt0jElohLj-cFZ3mnDnMQMKYv7qcz-P81if2AVjA&cid=CAQSTwAvHhf_MADGL80BEuS5A87_8Dx7lr_ed-JgwKVMmSCV1qf2wHo5Yfi0gk422n7oUUbMZ_ThNwUnEXGe3fWVR7ubBEaLKbz72azsMSy-J-UYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=8376042128687570000&adk=1215661107&idt=63&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86024
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:38:16 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 7B44 30 KB
11 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:32:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7B44 41 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1523526/72529856/ Frame 443C 59 KB
14 KB 529ms
54ms Script
application/javascript 54.217.43.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvELFKEPqoxsYzbDd79UnedmOoV87sf9xCoV1Ho_fC1Mx_ORsbyxn8Hm3OWz3ng7aqSoeMou0yIClxHLxIJ8nundWIxGM2NsbQYtYkJ60XFMp6L0adC2dvDdisLVIy7p4ENRtBFGl431o9lIp37btuz6vPcCxQbDEQ8Q_aoyE3B1UKrMx8cs4XCdah436iS5ftjKsJRxsokTvHW3KD3iQDga9Htx20af0zdV11KEh9QKWl8X8&dbm_d=AKAmf-DM2FcjlWLj_vYSAGmnt0zFfyZg-qcxjIw48ir19xYIVkr_XOXsk6zQSFF1irswjw3_VIgYVj5q1DQrW8uWLbqoktq3bD4IiiqQWW50NhzJyq2sCBuuLgPFyqxNfWJ2IBMdgXBNdSFzh6BNGmgHva7_02sgPh8Gdop_3uw6IciAYzw25wlH0cXSzzR7w87B2ASvi1xMu0YGCiKfoMs2k8j_n-_VL8AKVDWOhqplhi-shG7F3_BZ85z1BQZEbMUHuLFGsSKPXU6ZaWiXeM3X6mT1jMKcPp6zhu0sm04YI3cU5__qBjUTB9MLvV0hEXxRaIN9RJm9DmBFCGVsClj9nkZ4iKM-LBnQyKalxlc5SshW2rUOhZwo9UGj8LdCOXxF1_6VpNDbKYLOuaC5zitnNWyWvFVpqAeDTT2b29S2p_3J00h7vdZFKBnR5TKbPVI2CNG6u05MIdFoT5x609RTGG9G1er_8etn_gB6HrF0kblgY_UPdeP1yPbpjZs2LSztKp66io50OVzoEn-JbL8qmfXAM0NIyPeheuQSCGtzFMa2I-CNrvugFVrH2jEgBYGlPkDU1VSVUbiapobiziku91HzmvKYx1ISFD8P9XFEX5djN2QdGYzRLhnGyX0b5c7yma10ZFeakqjPwTTDIFQoJlFsojiPcvCZ4o5OKIoTlJuYrVAZ9fo-EeSegqIH5VwFkkvb0JxDvCfyLjWPyN7Ug8WIi8MY9dtUXfaqAj3Vl2u8GB73cW3fWeR3ufzcPY2UkysUf2JzOX-OLNIbEBjvWpIX25x35E-Ug9udNpo-Npp8IHV1tJp6AARXdfJLZQgntCRCmBGVQ7aIH_voik1ZrAysL1HERArtFrFnOGF4ooRK2mC1sZsfUdcFiOxH3GubqXjRUX_vb124GjL7qfBmxoMMy9PEwCpYPMFwA7WoXrl3fcWJxnid6OKp8aRXvKw8U9IxTSzIe3i8aeaNC_nvSmnxlr1pgknxHNL1yrH9C9nc9FJhF8UdFQtXeYo-qMxC0TUHAVkY2wUrBJuTxCtJMJ2nCOLt2Kmg0LRtNKPRxdWvOUFf0YBL3mPTMt2nsclhov_Iy8RN8Pvn5n_0ptKj3K9GYrk6TtV8wIMyX-zH9KyDzivEIN4_s-1QeuJAWMGO4C1DpTVgE3SZaHJUKaycHtEooFiopC7IQaf3lUgk45o3uvg7LQV7_6Czgp1OCdTLazVQnNLZ-XwVO0P2KO0gfQPvl19HUve3IXVAnDrBHk9BGlQILW_vzbfB_kX7s6Vv90ekQRLoX8L84M-QEIxq5o99tW9Cyzc2BvgJuk6-Hl82xGKSOj3ZtYLruD7sqdZbXt_IKbn1lwb435om5zr8iV0qRezyc2PwsnQwEaIezB6k57cuAYUQQoxVwMk2JEETpmpS1QM5pLnijPBIf88wqa1YmMPq3HE0e6cbAQF6Zz4XbKc9iGr3d9IbUvW9PBFArmWpMnHDxP8AHKrcK24AQFs8RMQFnjF8zcxnsfQEXK6fl_C_lDVb9Ae1f3NdWbG6BBnsjVL77VEpk0Q07cxT4gdqEKstMs3rODS36uo9lGu7AhBPGYRT2urqwe1gLRgoHvc5uv6dqFEXbVCbRBhS2ytC3WMKubZ6tMgRJNMQhsSAhAxoc3bcBmUZf5RKz91KqgSs2YmOCT3i79cPqM1V9y_XQHnoKSl8dLq_AyG859H3Jm3uL1Vu1KEpNC1rNzommTEiSufr6k9xz9kRthwM4pygJqnch3LtYQJLxZD5wXljqPhPTaJeSyRwN_Gnck2L2EYi-g-noIVbFH4aSep6LW21SqmBR79ytij-4MK3nIlEDrxYJJVuceVLK-gZCivGL_LyjGuS5XUMFx8I7AEVsCOrbTNkGEIWCeq9dxLKZgDPxMUiaOqecxTAetWgkhm4R4mFPw9jvelPLkZTSIfTvc9AUa9RDWSRqnAqQL-1J9nn--pB-AxL8L3fTg14ckPTY-QglyEUf4MNTp9pM1ROI6Fz6x-YFy5smFijv4t9Gv1FSEqIJS-SAy7eEptaRNyc_QZQJAZg0pBoIbUwvu_RfeNnOXpGFODwSbj_yxt-iVf1MApDgnEKxNokbi8nMPOF626C_UxyWjD5D-f4k7S1BnIUIZrUKF0HIryNL3ZDIR1A4XnlRTq34gR52oEe2rDFqciWIrUil1sBfvYoKZ8rNXy9lWUnfOvXqCDu4s4YjDtWp3lwOPxaQ05oWtNMOlnyemZgV0c1TI2fLywh1P1_vFYjPosrVtXuec5U2acrhxBsqs3pG1-Yv4WvS-L-1AgRUYShrtU6VTUTSbHBGqqhS-UlagTltrt-tWW24dNnlZ-D_8Cm7_lk9kCXrVpJslzYqPrwUBQB5nxAD8wFf-wEk2NIyvt2EIS5xN3ATbfNePPwUmUj0d8R_9jWnuBh9B9Sbk_XEoV1eA9PtmR2957hpMiZxX3FGwCDpqNswEaTLb9nv8XqhXjBf8bvUwlUDM12QElu6Ngu0okVaW1DMHIsglntmWXTTuTq-QlA3RNnBkR43ThVzhnb5A3RcK0fXJFpUXVHfP-U6bslWfMEfW-J9Pf-BtU6i63AhLlARS98PdtobKQV-0rWdjRMUAx2PMzGX_Z-ITOy80dr3MPFLKIzF9YheDt7VTFtYFSFOEu3ta-UyjRMKyiBWkVThRh_gbRHaV04yqzvBnf_nIDmsEmnMWVoMvQSbE5qbmnpnTHX859tZddhyq9vOrhitL1lgWLA31yrPuFIWb_K2ZjCJm_AQ3YArwN9ZkdI2vWaYP1RA4r9cyw6Yf2mJO5-5Bd5UoR4wOwIdKE4CIY-52fDH7I-CS9Ek-3Pru_7LHAYQEulKc4Qzb90fEdjSGwZLqznWA2GZpaQvi6e61KbqG8UdpkD2KSkIi_6skHeHacka7wklniQY1OxnzbEF1jYBVoXFWpCEZdM63s5hkR_Qh-1O_I1pmfw3KKNi8zx-VY0G7DI4_O5CTv7R_7cFopUYcav8LXrboOUCdL3cWc0xvE3BdubGTMYPY9Ffqufv5GDeHpt-ynhiYxpPDWK36cU8L-4XKCB4kfAY-q1xi638srhz7EZDrWoxJ7bwuazYhfjVQADJbZp0l5_-FOYd9co3rvpp8NvMQxr6MesrZ8r-9BsL6xMwZJtxOlj03Mxk3a0_2BdelzX5cucfsMI8gKcjexMkd7pDNIwTMEHwggrrYJb9QsXd4Hwtz4zesKGGvtl0nuFr-ilxfbfAuQp0PC3VW5knWeDI0xIwViMonx65pL-OeP-z2ymr0nFL9CCuy5ZgDpNwyfpeQ0uj-F-lYQavy7XiNBCyWW_sx19wOR6gxDQqUg0wEtP8rc5Bhbv3kBZALMmUzmefPY2sXHgmF-pTBrFz0F3fm4DeNvvyvh4q-tL4m5ckLKWlvYU3b9NUN8eVYhofRzsA0erpCtPoXr3RD4x2iNpKh6MtDrjdtDSEZWO6UJ77PXxNDIOV3rfiSN4Qau4sGzhU-632fC98dfXg7kUs57Fh8AbAUG0BnEt0r6Oh2EujG-TWga0Eaiof6iUwLtQ3JuL11Gm3UXetf6pDDF3ZLXaeiVYs-8fNNhzIKlicHAnRM9z__7nJDDFSQJBSSGrtHFOU5OAhkDmmu_3IHNGC3t4k_95U2Ab9VV8OomsN8joix0OWttKmUwcHMKMzd9kGDPUlIufRtO3c_X2ccZ0Ba5cpNqEm7FCSN6fS0lwyCy3ld1Pb3ybn5kMCYlNA9hR5aad9txPBZ_8k5PBu-_oqhM_2J6yI6BRioeeBtzzZ1HDomI77PzxrNVIyiWvIi2yuwmyJmNsavnO9C39Vz9hGPQIKR9srxg7vY-j6KSB1USeElC5zjubP7AizzSYxnYp9h_Kl-f0yYkHBCXj0fyxeFKPnwjzUujSC2EUxy69oRfNn58PmFVeMDGoydk0DV1FJjM4Lq9kKqr-ZoOH11jrJp80t9Mld1B0D1gsrDe2EPsiSoMuIUCLlSTU62-XcA8l-kdpTI6kFfkBI9SJnZa1CvVWXD5O2jQ81pnZdu2WZej-D_WJF4vumGBsiTRTizS14GOLbW_4YJ8&cid=CAQSTwAvHhf_B-4l2LhRglX0QsKiqGEuGjP18F2kNQAqLtqY017zht8jeGEGRNoE2CQez6Z3LAUAyVa0bKEFp_lNIOIaK9Ic_bjNQBHhrD9H5cIYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=5466578710995754000&adk=2228999114&idt=69&cac=0&dtd=8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.43.2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-43-2.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 54c25767ee7ccef1b045e40a22fe4c154b6412fc0ac35979b86ba6412ed90783

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 949633428269317471
s0.2mdn.net/simgad/ Frame 443C 54 KB
54 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/949633428269317471

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DvELFKEPqoxsYzbDd79UnedmOoV87sf9xCoV1Ho_fC1Mx_ORsbyxn8Hm3OWz3ng7aqSoeMou0yIClxHLxIJ8nundWIxGM2NsbQYtYkJ60XFMp6L0adC2dvDdisLVIy7p4ENRtBFGl431o9lIp37btuz6vPcCxQbDEQ8Q_aoyE3B1UKrMx8cs4XCdah436iS5ftjKsJRxsokTvHW3KD3iQDga9Htx20af0zdV11KEh9QKWl8X8&dbm_d=AKAmf-DM2FcjlWLj_vYSAGmnt0zFfyZg-qcxjIw48ir19xYIVkr_XOXsk6zQSFF1irswjw3_VIgYVj5q1DQrW8uWLbqoktq3bD4IiiqQWW50NhzJyq2sCBuuLgPFyqxNfWJ2IBMdgXBNdSFzh6BNGmgHva7_02sgPh8Gdop_3uw6IciAYzw25wlH0cXSzzR7w87B2ASvi1xMu0YGCiKfoMs2k8j_n-_VL8AKVDWOhqplhi-shG7F3_BZ85z1BQZEbMUHuLFGsSKPXU6ZaWiXeM3X6mT1jMKcPp6zhu0sm04YI3cU5__qBjUTB9MLvV0hEXxRaIN9RJm9DmBFCGVsClj9nkZ4iKM-LBnQyKalxlc5SshW2rUOhZwo9UGj8LdCOXxF1_6VpNDbKYLOuaC5zitnNWyWvFVpqAeDTT2b29S2p_3J00h7vdZFKBnR5TKbPVI2CNG6u05MIdFoT5x609RTGG9G1er_8etn_gB6HrF0kblgY_UPdeP1yPbpjZs2LSztKp66io50OVzoEn-JbL8qmfXAM0NIyPeheuQSCGtzFMa2I-CNrvugFVrH2jEgBYGlPkDU1VSVUbiapobiziku91HzmvKYx1ISFD8P9XFEX5djN2QdGYzRLhnGyX0b5c7yma10ZFeakqjPwTTDIFQoJlFsojiPcvCZ4o5OKIoTlJuYrVAZ9fo-EeSegqIH5VwFkkvb0JxDvCfyLjWPyN7Ug8WIi8MY9dtUXfaqAj3Vl2u8GB73cW3fWeR3ufzcPY2UkysUf2JzOX-OLNIbEBjvWpIX25x35E-Ug9udNpo-Npp8IHV1tJp6AARXdfJLZQgntCRCmBGVQ7aIH_voik1ZrAysL1HERArtFrFnOGF4ooRK2mC1sZsfUdcFiOxH3GubqXjRUX_vb124GjL7qfBmxoMMy9PEwCpYPMFwA7WoXrl3fcWJxnid6OKp8aRXvKw8U9IxTSzIe3i8aeaNC_nvSmnxlr1pgknxHNL1yrH9C9nc9FJhF8UdFQtXeYo-qMxC0TUHAVkY2wUrBJuTxCtJMJ2nCOLt2Kmg0LRtNKPRxdWvOUFf0YBL3mPTMt2nsclhov_Iy8RN8Pvn5n_0ptKj3K9GYrk6TtV8wIMyX-zH9KyDzivEIN4_s-1QeuJAWMGO4C1DpTVgE3SZaHJUKaycHtEooFiopC7IQaf3lUgk45o3uvg7LQV7_6Czgp1OCdTLazVQnNLZ-XwVO0P2KO0gfQPvl19HUve3IXVAnDrBHk9BGlQILW_vzbfB_kX7s6Vv90ekQRLoX8L84M-QEIxq5o99tW9Cyzc2BvgJuk6-Hl82xGKSOj3ZtYLruD7sqdZbXt_IKbn1lwb435om5zr8iV0qRezyc2PwsnQwEaIezB6k57cuAYUQQoxVwMk2JEETpmpS1QM5pLnijPBIf88wqa1YmMPq3HE0e6cbAQF6Zz4XbKc9iGr3d9IbUvW9PBFArmWpMnHDxP8AHKrcK24AQFs8RMQFnjF8zcxnsfQEXK6fl_C_lDVb9Ae1f3NdWbG6BBnsjVL77VEpk0Q07cxT4gdqEKstMs3rODS36uo9lGu7AhBPGYRT2urqwe1gLRgoHvc5uv6dqFEXbVCbRBhS2ytC3WMKubZ6tMgRJNMQhsSAhAxoc3bcBmUZf5RKz91KqgSs2YmOCT3i79cPqM1V9y_XQHnoKSl8dLq_AyG859H3Jm3uL1Vu1KEpNC1rNzommTEiSufr6k9xz9kRthwM4pygJqnch3LtYQJLxZD5wXljqPhPTaJeSyRwN_Gnck2L2EYi-g-noIVbFH4aSep6LW21SqmBR79ytij-4MK3nIlEDrxYJJVuceVLK-gZCivGL_LyjGuS5XUMFx8I7AEVsCOrbTNkGEIWCeq9dxLKZgDPxMUiaOqecxTAetWgkhm4R4mFPw9jvelPLkZTSIfTvc9AUa9RDWSRqnAqQL-1J9nn--pB-AxL8L3fTg14ckPTY-QglyEUf4MNTp9pM1ROI6Fz6x-YFy5smFijv4t9Gv1FSEqIJS-SAy7eEptaRNyc_QZQJAZg0pBoIbUwvu_RfeNnOXpGFODwSbj_yxt-iVf1MApDgnEKxNokbi8nMPOF626C_UxyWjD5D-f4k7S1BnIUIZrUKF0HIryNL3ZDIR1A4XnlRTq34gR52oEe2rDFqciWIrUil1sBfvYoKZ8rNXy9lWUnfOvXqCDu4s4YjDtWp3lwOPxaQ05oWtNMOlnyemZgV0c1TI2fLywh1P1_vFYjPosrVtXuec5U2acrhxBsqs3pG1-Yv4WvS-L-1AgRUYShrtU6VTUTSbHBGqqhS-UlagTltrt-tWW24dNnlZ-D_8Cm7_lk9kCXrVpJslzYqPrwUBQB5nxAD8wFf-wEk2NIyvt2EIS5xN3ATbfNePPwUmUj0d8R_9jWnuBh9B9Sbk_XEoV1eA9PtmR2957hpMiZxX3FGwCDpqNswEaTLb9nv8XqhXjBf8bvUwlUDM12QElu6Ngu0okVaW1DMHIsglntmWXTTuTq-QlA3RNnBkR43ThVzhnb5A3RcK0fXJFpUXVHfP-U6bslWfMEfW-J9Pf-BtU6i63AhLlARS98PdtobKQV-0rWdjRMUAx2PMzGX_Z-ITOy80dr3MPFLKIzF9YheDt7VTFtYFSFOEu3ta-UyjRMKyiBWkVThRh_gbRHaV04yqzvBnf_nIDmsEmnMWVoMvQSbE5qbmnpnTHX859tZddhyq9vOrhitL1lgWLA31yrPuFIWb_K2ZjCJm_AQ3YArwN9ZkdI2vWaYP1RA4r9cyw6Yf2mJO5-5Bd5UoR4wOwIdKE4CIY-52fDH7I-CS9Ek-3Pru_7LHAYQEulKc4Qzb90fEdjSGwZLqznWA2GZpaQvi6e61KbqG8UdpkD2KSkIi_6skHeHacka7wklniQY1OxnzbEF1jYBVoXFWpCEZdM63s5hkR_Qh-1O_I1pmfw3KKNi8zx-VY0G7DI4_O5CTv7R_7cFopUYcav8LXrboOUCdL3cWc0xvE3BdubGTMYPY9Ffqufv5GDeHpt-ynhiYxpPDWK36cU8L-4XKCB4kfAY-q1xi638srhz7EZDrWoxJ7bwuazYhfjVQADJbZp0l5_-FOYd9co3rvpp8NvMQxr6MesrZ8r-9BsL6xMwZJtxOlj03Mxk3a0_2BdelzX5cucfsMI8gKcjexMkd7pDNIwTMEHwggrrYJb9QsXd4Hwtz4zesKGGvtl0nuFr-ilxfbfAuQp0PC3VW5knWeDI0xIwViMonx65pL-OeP-z2ymr0nFL9CCuy5ZgDpNwyfpeQ0uj-F-lYQavy7XiNBCyWW_sx19wOR6gxDQqUg0wEtP8rc5Bhbv3kBZALMmUzmefPY2sXHgmF-pTBrFz0F3fm4DeNvvyvh4q-tL4m5ckLKWlvYU3b9NUN8eVYhofRzsA0erpCtPoXr3RD4x2iNpKh6MtDrjdtDSEZWO6UJ77PXxNDIOV3rfiSN4Qau4sGzhU-632fC98dfXg7kUs57Fh8AbAUG0BnEt0r6Oh2EujG-TWga0Eaiof6iUwLtQ3JuL11Gm3UXetf6pDDF3ZLXaeiVYs-8fNNhzIKlicHAnRM9z__7nJDDFSQJBSSGrtHFOU5OAhkDmmu_3IHNGC3t4k_95U2Ab9VV8OomsN8joix0OWttKmUwcHMKMzd9kGDPUlIufRtO3c_X2ccZ0Ba5cpNqEm7FCSN6fS0lwyCy3ld1Pb3ybn5kMCYlNA9hR5aad9txPBZ_8k5PBu-_oqhM_2J6yI6BRioeeBtzzZ1HDomI77PzxrNVIyiWvIi2yuwmyJmNsavnO9C39Vz9hGPQIKR9srxg7vY-j6KSB1USeElC5zjubP7AizzSYxnYp9h_Kl-f0yYkHBCXj0fyxeFKPnwjzUujSC2EUxy69oRfNn58PmFVeMDGoydk0DV1FJjM4Lq9kKqr-ZoOH11jrJp80t9Mld1B0D1gsrDe2EPsiSoMuIUCLlSTU62-XcA8l-kdpTI6kFfkBI9SJnZa1CvVWXD5O2jQ81pnZdu2WZej-D_WJF4vumGBsiTRTizS14GOLbW_4YJ8&cid=CAQSTwAvHhf_B-4l2LhRglX0QsKiqGEuGjP18F2kNQAqLtqY017zht8jeGEGRNoE2CQez6Z3LAUAyVa0bKEFp_lNIOIaK9Ic_bjNQBHhrD9H5cIYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=5466578710995754000&adk=2228999114&idt=69&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f27e195da0b25cdd63e724d9ac44ce92a57eabed5392fc9f138ae90798ae6cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Tue, 11 Feb 2025 20:44:42 GMT
date: Mon, 12 Feb 2024 20:44:42 GMT
x-content-type-options: nosniff
age: 330438
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55369
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 13:05:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame 443C 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame 443C 12 KB
4 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86024
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:38:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 443C 0
0 48ms
48ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuYgpcfpP44lppFcRPkX4zn0syHOhJbZXVbmgwBd2gfy10p5-TTGvD1Kfe1M4ZvOy6_XMHMjj0L7LVkhF1-vq6MosX0io1Mk-5z06iLE1LO62Kjwf72G3RV4O6mCjkmITPVl9BeHFCpHerQ2bLDX5S_XaFKTeMxlhVO3hcVfcX4G2umkZ7vm0JGh7CfsU3-vKRj-7GhornKQw_4ZPVO_CgQWP8jtDJNDuaGOjgSudEfGOwnG2NS6mrEI1GXSbLg9BEmY51ozSPe73rPQwD7wABrFaOEDZJZEDRm75hggbW7Fek1HAr15EUhtRAPoB34jWZ47gw7LYrKLV4_OG2NDFPJZBVlQq5F_-JBSTabwZNYWXilU0-9PMHtaNEXUQWlKTQXl6Pln2DP6L3KolWcXxK12bS4PZ59wvZwoeIozQai7gv8mUMcC2NM0ztcvQ3IQquJUI9-fl5ZZUtshYGk1H3IwGkpBNmOrRoXYr19JDEjsrIW3TmLOrdtvPYc0FXKjU7XpHGg8N9MaPa0xIqwSY9_K92kDcVaHVBQS7gdubpc4DHL5Um9FbpNd7B44VEyXN5MsNX4zVS6umlL-SqqLGglBI7DOrzlZjHmTh7uWBINrtWPDQxaAQJfJZkU82KPcpbfN9psSCtPuwk2shexpcvJYddBfvh1Q7F7TnxK0aoFR5fGScavKOxEUBHY5bbHqvqkmZ0fOkFN7T1iIkcybiD7lJf8Qi3BrsolcS-04EN-jzJ-v9HsbIlNoHyVeH1KmhTlzFlauL0e7SPI9SSHVtF-PXhcgaXmW-cDCZK034xfCPGthxiiklK8ggTKaaODmkAMkGtDGiQw0k0qb2Kd3nk0NkzjRmbVLEIlbQMG09A4Xvx4AqmbR4hWCN4KVP4KyzfIFqNgtFbul1jUginCbAQF1bS5xr91gSZuguYvqxre6zg7krvsf9GIFiNV1_npbrSHWpmorE6rzmlAo2_uPlFBuHILbW-ybLzTMWnYAvb_JlIkeE8vLfpS0sfeWnP_KJ1CE-8eEace5a5IQPMb7m2Y7MVpM0DcBu72EEOlVDfc_Fv0r-EKMMD_3pmjHp8G2CW6VybYJR7pXmPJpqoSFPbwfyemV8e0AxPnYZqGv0ucETecRkIb4lXT2viSKK_2HcDhXtTuixgrkr9MaWam05IQZAjRfADvuGJ-3seoIhKHj6_grgE8ycn3I38egKqoRNcBNgbgUG9lzMT2u-LKzBRkTqdtQdpdFhHuMTKQ3wL1p2T5s7K958cxUWBed92lNwPPmrCEVlWBZgYKluaMoEu3P7V5Szl1kgON0jVumaG5l0jD-zuMGWjofzaBqniwPXViwnH1g3jBiAtzFBAZUoMPyY2jbGPO00E9thfdFrTmhry3yf-G4HafAATicBb01cB-fLoNwq_XG8mWi3R0uauQt3qayYh6j8dQNbvlZsJNcZI_gb-M9aYlD9Bz6l0gkboYLrIw0pK5NM32iE5iSA&sai=AMfl-YQx0LkYddzW6Nw-2JVPXmzXTLjp8QW1XpzHypiuOs_soBuaq_-WsLjxYEQYC2nbcMb5eGZXW2E46dqLHLMXSw8R_YYfIiGrkjM5vIJ47nfJANplbA0hH2N6GJ0ssyliFYce76NNkaysI_ybwfluYesJ_I7TrJIUW3XKDQAtMAn06BR7hRNmYdGoEhYnLtz3YPM4eNraluAyYBGI0Xw-9yKvSD9HH85T8UV0KUAMWEfJTjEF3hbMFsi0kiXplsG8fuGvUT4XpXqqWvTE4qBqA69eww6OANb5nd-honVIqw6F0duAslEU0CcEuxqpQnZBtytZ&sig=Cg0ArKJSzN4uM8EX3JDJEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20240214.66423&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 443C 41 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H/1.1

200
OK

request.php Show response
hal900023.redintelligence.net/ Frame 1418
Redirect Chain

https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ae1bda8cb6&subid=&uid=392081d8fb999cff&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ae1bda8cb6&subid=&uid=392081d8fb999cff&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

613 B
936 B

149ms
127ms

Script
application/x-javascript

78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ae1bda8cb6&subid=&uid=392081d8fb999cff&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXvui_43PZeXFNuLs7OsPyMmUkA-m5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0Owk9oLq8YXQmdv_meE7aH8DFq0dg-mx5Mt0gwI4ew-cjT733sP9yxftZINe3XS4wgqWosYCQ-aAWL28BBeLyR2b05uz31uRPuswEK5cYxIwVT8v1Rl9owzACJGSVZlSFW5cFe4BkFL4MN3MnFSkSqFJBCWGkEjcXwYc6R7HtZRoSmRWbBWFqp8QsdC7tBhEY5ga0N4TBRFXtNfMouMe9I_NAZHKvp57NVLGwuDdLDURfD--S1NNumm_D0XESMrNMgqnk595-fQ4B5NQVEim4h_MRAoCOI2mVsPZFA5bKt0vhHEgOpn85pkovs1BZdnuVHfAXWQH43jvxsFyyjTor1xwAkS8bC7mn9XzdqpmwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljXqO_DpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB%26sig%3DAOD64_0VoNECw7f9nS9M5vGzWf0YFtFWww%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C-wWTMDDWQGakLHEMzpN0tzzDuNxn1N1khVIltq8eaq1cDBvOcZMngXyb631m8eyDfJ15Gr3nFlvbnJpBon82Pn7Z2B-PcagIlsBuwJJrIW7paPiDzSjtXovFkkHLFi4ErTxlbHrWGpt4trqRNRTCW9btO3piQ022uJMB3wy2bAjV1Aes%26cry%3D1%26dbm_d%3DAKAmf-AO-b2F88hN9BU3WprayDHvbp33UeGfwKc1fmj9SyLDeHB1Eg79WP3OoVCF8PN5QYJDKKNw5j_8Cyc4ZvJkv-TGdvOrjYs2SMkJCTXX30WiT49BdSk1k1ZT0Dj8anP1drDwUz15JGCh8L1lM1APUCw4Whs6Tg5ErqwAEvYN7rrNOLpaET-LUJl2D6ixe56SzxV5KONXOrK7l9knGe1t6bb4dSpsIxFsQeE3YTKlQerIAEJlpL01kwUsRrO5I8SZjt3ew-Q8NKvWYpRzNpIQ6_zUgCtN8KN3JhxiQgTTSpiThuL44HhGqOInmN-2nBZCAxfwN6INPextX5ribUj6b9faKkOs10JoVkIbuAvFSeuMIKuJrSFS2Y-fya63ecX3hw9uzLg3eX9ZqYjynM1XIMPcIR0eTwCmHZklYMz8vgxNs_14bjH5Dhvv7SeSJ50XKd4fiZi3Owz-UDvJs2LbhFblZW6L4GarQD2zr5m6TKJsBkTz70fQPSFnleu-r9wtx69zyXsr4qCggS9X89zYHof7N6sZOle1_5RCng6bolR6RB74kDA%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=6970069046205&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=1862325903&adk=428964698&adf=3949364092&pi=t.ma~as.1862325903&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119738&bpp=1&bdt=898&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2385&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=6&fsb=1&dtd=4
Protocol: HTTP/1.1
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: a0b03f03553500f8ecad57f692598fae74da17c1f3800e45eeaec8fa40f104da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 94720300137361804444554012602023
Connection: close
Content-Length: 330
Expires: Fri, 16 Feb 2024 16:32:00 +0100

Redirect headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:32:00 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ae1bda8cb6&subid=&uid=392081d8fb999cff&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXvui_43PZeXFNuLs7OsPyMmUkA-m5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0Owk9oLq8YXQmdv_meE7aH8DFq0dg-mx5Mt0gwI4ew-cjT733sP9yxftZINe3XS4wgqWosYCQ-aAWL28BBeLyR2b05uz31uRPuswEK5cYxIwVT8v1Rl9owzACJGSVZlSFW5cFe4BkFL4MN3MnFSkSqFJBCWGkEjcXwYc6R7HtZRoSmRWbBWFqp8QsdC7tBhEY5ga0N4TBRFXtNfMouMe9I_NAZHKvp57NVLGwuDdLDURfD--S1NNumm_D0XESMrNMgqnk595-fQ4B5NQVEim4h_MRAoCOI2mVsPZFA5bKt0vhHEgOpn85pkovs1BZdnuVHfAXWQH43jvxsFyyjTor1xwAkS8bC7mn9XzdqpmwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljXqO_DpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB%26sig%3DAOD64_0VoNECw7f9nS9M5vGzWf0YFtFWww%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C-wWTMDDWQGakLHEMzpN0tzzDuNxn1N1khVIltq8eaq1cDBvOcZMngXyb631m8eyDfJ15Gr3nFlvbnJpBon82Pn7Z2B-PcagIlsBuwJJrIW7paPiDzSjtXovFkkHLFi4ErTxlbHrWGpt4trqRNRTCW9btO3piQ022uJMB3wy2bAjV1Aes%26cry%3D1%26dbm_d%3DAKAmf-AO-b2F88hN9BU3WprayDHvbp33UeGfwKc1fmj9SyLDeHB1Eg79WP3OoVCF8PN5QYJDKKNw5j_8Cyc4ZvJkv-TGdvOrjYs2SMkJCTXX30WiT49BdSk1k1ZT0Dj8anP1drDwUz15JGCh8L1lM1APUCw4Whs6Tg5ErqwAEvYN7rrNOLpaET-LUJl2D6ixe56SzxV5KONXOrK7l9knGe1t6bb4dSpsIxFsQeE3YTKlQerIAEJlpL01kwUsRrO5I8SZjt3ew-Q8NKvWYpRzNpIQ6_zUgCtN8KN3JhxiQgTTSpiThuL44HhGqOInmN-2nBZCAxfwN6INPextX5ribUj6b9faKkOs10JoVkIbuAvFSeuMIKuJrSFS2Y-fya63ecX3hw9uzLg3eX9ZqYjynM1XIMPcIR0eTwCmHZklYMz8vgxNs_14bjH5Dhvv7SeSJ50XKd4fiZi3Owz-UDvJs2LbhFblZW6L4GarQD2zr5m6TKJsBkTz70fQPSFnleu-r9wtx69zyXsr4qCggS9X89zYHof7N6sZOle1_5RCng6bolR6RB74kDA%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=6970069046205&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 16 Feb 2024 16:32:00 +0100

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 2961 11 KB
4 KB 33ms
12ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708101119926260&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCyvJe_43PZbTEON2Ps8IPgu-X0Aqm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0LKti4zOx8rRdh4VawgPocMunoZXzJ2_HWuh_ouJRtCUdswQTHTgAZH2b74JWGtsV2Hyo24NTVaPX9ZkbJIRnbsvQ8joAvERNtX6L7kzzW6VS_7mjebbWZw7YGUXf68W7Yt13IDFDoxB01CE8tJCceOMZ5EG4Dv5S8MO4IODAmIxBFhtVgr0pOVkX908OeF3ELJrw75fJnDlygmSHPMvmoYu6kyhxP9jy7CUZkxOJzOTRM8-AF7K1grj3JsdHQl8FuYQnhzK2Ypf6vCcbp6Kq5vQ6kef9AJ5QuwFHtFqiK6YDQMHyJ0ZI5hUl0mCwBEB97Kx-cc_qwm9eKYwpTktkIs_Zpv6iw0K2TdvH7zLwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljNo_HDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ%26sig%3DAOD64_1-Hk9V1IUruPcYt9nZJXt8kExzrA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Co7_H40pnwE8avewPHokHcFUyi-zjtfJmtz7rIQg5dMgMlDGBCEgKu3s3GNgJJeoKGjakj8yz2jdms9SCUl0q5FWvRm7HWSPqmCBoHMHkG2DUdh1RCOH7MZMT6h_IXz29In1gxH_1ix7yPNQzOTXgfjvAGCWC-yZb0ZRVv0KiblWzi-iY%26cry%3D1%26dbm_d%3DAKAmf-B2ymos0AmDGEcPYSBemv_qhrDQv2jdJu6iH5vCdcOmmgMOjrZnKS7GeFVgitXFtjUKpHHWWlKVOGWOQt31utRJ9fyqldHxrRW07-YkJRLglcQEG3MSwhXgQs2bs3PowZOiQ3AuJdrJMy1SzFGfGMIyzi-9q1t_TW_CQOuxVODeL_tHu4hSy7GOAXzllnBxknZAlEjsESNsoocgQ7c5aoKxzJ1-uV3k3-vfcSJU-4ZEbX_JqoTWdmV_evxKgzscTSVoy6f6bAlzQKWFnToNuSvKsHUcJSirHUsOMpotb0zjFa6OAAt5sP3IWus9FSY3rNDPQExKXakR43dgFwZXLF2l9nM_4WQAaXJ4BBpOJHnlhYpOKiZxU-9GUeHYdafQyNeT5k1ITm-eUnZScmu5ZbU1IlgCj2BcG0fQJrqNLJkOPnBAnCbDi80sjG82JVx-_fLQ-uiWtzvu3K_ArbKCaLLK1swEtwSh511A3n5QaZzE4lUsEfpD-D_Iz5C0M-nCS65bh8mDV_7IGmps8SW18sNO5pibn7UwOTIAPZuCQrQgvV_7gtM%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5b6b1ebe78c0d3dbe3a9ac9905d6c31e6894ecb45303bd94d722740d0ce37e0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4206
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK okg862ss9p0j Show response
hal9000.redintelligence.net/zone/ Frame 44B9 11 KB
4 KB 34ms
13ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/okg862ss9p0j?subid=&gdpr=&gdpr_consent=&rnd=1708101119944990&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCocIf_43PZd7WOfeLs8IPzrq4uA7r0sGhaZ3x3vTFD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0Her24VIBIaUEDWXsvKsO-j5YZll5kXev_UJSxFup00DmiObNLBjxDUiNA1bOD9yiJAtfqrbXioVdOFYFv2Iav7fWCTKFSrbWFbB84mutExYx0rxV8pN2t12MyhC40BBFKovXLN_fLfpcS3PvegxjtzA1yBfzpRbe9wngwLlStDNOK-_AAX4nnBw2eWw9fmRJeELWy75rxyaj7wWg-J66Y3BSTXlHoO0E93Vodlz4ydgHKdT8s_o3X9yDBPKd6JuS87aUPJ_alYPfpkqEDG-lDWexFr6eNlqr0KnVWhKqi6Sske030Bw9uucR188CCSScWn4lngJvmuUlSp0VtejqmwAr3w_JsCl01EZRbD0BmaN6Bj8wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliUqPLDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ%26sig%3DAOD64_08bAxOP5KNznc1wKtjtfAOmMiQ8A%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DNOghcbn8S8wfoQBdLS0kYjBKXUJ00Z4bN7iRkn5A-Zt1cgmAOyJHPWtTTH461_sLf0H9rH56VvssPXmyY44rlG3SM35HFm7wdWM2iDuaR2l4hlhQCSZ4scw92m7YMr5IoW7TAsekcain72m9jQJm2r8T9FsC-X51FnJ9PySA5lF2hnlY%26cry%3D1%26dbm_d%3DAKAmf-A3zSLfbP5DM360iAJqy1nHEWmDLa7ZmIacJx2OF_8R_wvM8G_8rKuCEISDkBJDI_eILe70VlRM-U7CBpPEY8Au1km467Y3YtGGdaP5u83VkbDdvZ7O_ELv2nnNfrMxQJw2_RuMyD7jrJMDJRcjKpC7llymf6ZVjspLrSp8ubJlLiVDYfg0puBBex4kgFG_QRsaiy1vo5uU_SImiaQXAdfQAE8BqXy3kdWFB3XH-ukD9ArMRMcphaDZFbK9BDvH9noJjSmMWy2jACBsDvGMbQ6L7YiGYtJwIRPe831vbAGW25avGmlotzA9UoT-RHH33HQW9P-WsLJ9mAAs-hk4h512J5o-Atx40xTTURps1QlqA9IrWPISWW9udcp-R2bdmm54um-p1BCEIs_3ftvVSAJQ9VYo7nV9mWYG2cGYQIJgxSnosBiRdnnvTuDIasMUD608-Gy0ofBs3Y8kVO0yDlKY20bwMI8ZL2zZHgKyZr4WzBeA4x3ED_YxYKAZkousBTct21bV6jZEO2AKlODm8rSCIGV_a474J_AVLm8QedYmINafRO0%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=3548587916&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119789&bpp=1&bdt=949&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=12&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a785ec031f774a6dc13d5bc7c724f45400b632ed345bd9426e6ebafbd5967d9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4206
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9C3E 0
0 44ms
42ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst60Lf8VNNbfyVLmeoGPYyMsTzZVvHr7MATXQy0w3lLRcQ7DxnsKhKbi-9e7JOUhxKRZLi58YSyuokt0yerv5NLkzRY-qpSJiHP72hIsPiEhELHKIlM7SYI7hhHItBNmqnf_RCqCCiYNRQF0X0JEW6JHQmA5BZBPZV1IkHH3_EF6Ti4CZI6MSzl9q4mtfHcdZ6TmqgRgKvsnQrgi0cfrmelwyZYIZanQw6ZpxmQd6G43KAaiq2iIQhOTtCKEXVCNpvqHI7fFcwPbENcjUzy-G0A2Hs-nG-Zm8mOpJfz85qaM0zMG2igUlCgB3AoLJNnyFW3k7bAi2Vl25UUr39-UgZDEAn1wwJ-f1Mw3gjM_0jPkj7fMmG24TJqVcuvC1NnrInZ0t4sUwy2qH_mEUsCRQN-cJyKcmCgZ74oZsQUOvhTwYWmUHiioRxUWBP3oCservVQQuTGtcOzse6MwiM4FwJtCYud3sfbdP-WG3MXKK-_I9cJMF0AMG13SsnobDir1qNtVFqUp_aWC4_yvky5CFL9o60SAaGYWq7F6psIGO58M-PDh2KQ8gdNfi4LjjcQsulK_csl5g_p867DPhac5Mc6wJUXu7ADQaVYlIcwzDYEhi3gcVWUXlBuA-e10l-zZu3r9VK9OhPhdkQwCT-QRbQjD3-juTksdMnaf3DJHlmzsU_OCcgmC5ZjfkXxK5j7azyG86sEFm4_byhQJrUrcyq_ALTA_W9-_68TYC0Yny9i7CoYLnpV9QEGqGnFKBOEcpTYb1TQ0mHy7aK2vZMzWfwHprCuqE5M7vLd7boJbFlQ2Rq69TcDz66vsZfUNX4MJ6PjsuW11k-Hwr9nhIHkPiYJ6caqTubuD5tJ1NQYDbSF8a2PTiJnSc6GfkoHtSzCZx9zKu7X3jE88JMU8Y8ZG5SZdn9UU9k4cYNIwAFgz0m6xIp2bUJY2ZlSsvsOhY42goEWuXrKu5I2tZBbmv28oYvFMCZJBuAArhM33wrkQUAkN6QZw2zBUw3WobWrXky78U67BAOGRBJdUqRYQx_Ruh-c9O6LaDpoE04tQjpqVre1wyoRxkBQVzEDoPv1txS17OhogppU56JwpnVxzAf9UaGkf6c9iecthJVacnyjVsScZg6MLrrn_5lHeYpUAINMDW5Hqq064h4lMxWlGldGhcH_dXJNtomaQsJtgGciSI6yIrsD3_emlQmIDv1_W-R8VxiITVkH3p0s5Rr1kygOA5tpyf2e7NZRcStHncGViGx3FNScjpRK_mKrAU1mq6EAB8kK_T3okJiP6m9Tv69wDxCF-a7NkjlebysdRZFfjTybS15HjuQ26fhFVg_rvHYT_8D6ghBpETfXQSf1AV1WV3xTvcxSsg-6bGhnmncNqTdGbnsDamXYMCYZz4RnLtZSp9e8U7cbfEWhITVZt7wdMyTG1olCtvUNo0Pm85mejx_89M-04gI58F9BkVYoDB4kSkmcsOVru80Fb3-8EYKebA&sai=AMfl-YSKSbYwVN7gm7IMj3JzWjLlu5pGjGNEdNoNmJh4Q6UYEl0dLgwgNcuCtd6I4cFrMbl1NUbvUpSJ6dYkuE2tyjj7rP2uHvI74668_p1VOnZ0EXRCxomxA7xX7MN-ghxRLlsISp_chEBgHlm3LwttKXV0A02OY13Lk75dHJoKTCs71Yv4BOjG-lRf1oDXhXZDzabo3iga6o65IwpyL7K4bHzRA3TYTxovRnA9v98eXcvf2b2jI2TVTVqM-DXzIPD_lotC8_YxG-8VIkAz1dgy-MMOR2vOR770XK8dFZ2KBGzbuTkEzpDIzOEn0vzj37fX0Dtv&sig=Cg0ArKJSzOdcByz0VKNAEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=110&vt=11&dtpt=109&dett=2&cstd=0&cisv=r20240214.06185&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame DA58 6 KB
811 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins:300,600,500|Roboto+Condensed:regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3351f19e34694bcf05d6f9c169d0b9fbdef92064295cfdf7b91156b56c38c35f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 16 Feb 2024 16:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 16:32:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame DA58 32 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 17:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82625
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 17:34:55 GMT

GET
DATA 200
OK truncated
/ Frame 57D8 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3411007126d541813fe623a71ea570a89ef4eeea5d0490aeb11d543cf619a66

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 57D8 0
0 41ms
41ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvP7h1kmcpjk2sv38LPExHzeBegRxw3HA82L0Hk1Jg3JbtyOQwl6XpPc1Cj9lXzIModIM0057wf9a6MOoE0WULgBg3PzNWlu-cZYxnG7NijxGGEtrQsfHa5LuiDSOwcfpsSzL54RdZ6zAzi7SxnyZNmyP_SSFXxGaBNsQEFXWrODCWr42lFlDsCRLCxCkESfi49IB3YbR2ZDpW2UlQ30zbmajs42jr7yeCoE-LidrQoGiFYDTRIXgWF92pWJcVdeqJ2otVQd0gcL7ttH_vz2XHVYQni52VGv9WN-LHrE7W-NuGhXlOsy189t5IediSXuhDlmgfsiqdUMQ5Z3RNbOSyKu4xFnUuylOl1Hi0m_Kdt05YCEQt32HV-lB_8L1FxHjwpi1bEKgslkx_BqaWcwwqyRso-j89SzV8JXW1jCe7dgEz7kBxr9MDDmrpbFlxpn7LuK2rvElMVE-8LH4jO0FCBieiE4ftEHMPm6OkuCiH5F5FkpVNyZXr2fNFWOT72NpwhDsAeAvOpurRD8BL11_QDyi33nX90aS-EH3xFzQ0_kY-Ng9dsR8dNLIxe1onphJcBTOIPASW63UO5x6qJD1LHxPozm2RTM6iTS9xm-YZ5vztz4_nFJGiA8M92ZZOng8MPMEbIei0IYtlg5ofNUUIYM-NbslI-cz5UkGhkExvvXcKJNZLKgOWYn0DAKthv_8nmsyea-yGCwSHWgpnbPiUuQ2mQy2oq9EHDKtXwcU-lZl7ASkW7ZORFezRR99f686H9N4CjVWc8LN0Ir5PLlKYHaz57c9SBez-4FxJ2lThqbvrvEFKt3pPEBDV8bX8Oq8Ua9_vUGE7cZn2kjM39VCDQcR7kuG5xn0TMbs4rMG4UzxqVyAe7IUv8WUcHrBHyis790Wtgk3i8sqS8Pe-LYlNx-HyfgTgToit6fORUL3gaN_HMafuFbNzGMOsorOKHsxwOFbq69qaUH-7qip9k5PfeOv1FLrnrkrOmGb0i_9APPW5Yt9sKSmoBv2QsgHM2YsnDLQiyR1LkKGuYw1uOetV66TKJlZ3Ezvtt6EX3g0PSJTTIiEM88PhUky4eGj4zE39MlYVRzhAxmF1FueO0yu8XNM0BoddMXXAkVVlSC-3LrkftZCwRszVfqDAREFWmk0G_wkcYBa0zzF2UdjI6JgHMOUyuvd7rDl0xHAUfJp5Q8dshBK-W-nIA0DUTWOMOB9wtQ-sKaDp7SQpSs1MtjYlmcXUJezu1NVJCyPNK13QGLUrywFi-a4bOX-mnuod7MIiLdQDZM1vhLYvgfMY-iBBlTXcmlnYXB0VMoLjuK48-GeXNzhxAp6dVup8Fj52px4wsCAXpGAVeC9e1i6h3X9gzVhW0ofK7l_xzXyMn-Ywe1oF5KaP1DnELnZQ4W61QU20UqpPTJz1KnUVOV4qq70Uag1Le5s5mw3tZh9Om5kq1TsIz_hgj8YecM7ypY6nC-9ilUacTJuUUJvVCG10wqnSxS3b7NxQGhBfoDg&sai=AMfl-YRBLHNRrX5n0b6vMFfH_jkRPEmPmvHufiLc5kaulqzkTFvZ6_zAKdxCVHUK0bmZAEPzS8RWLKis0LCHfidsOKuC8W-OIoEyVRe5cnBXlha7LmNpO1Q5jBwdkIgBefYAa5ONKnZH69AFZaonBsdetJLfVyKbu5HPEJVJ5cnAduZD4mJtqOJT01OCcZtah1iBn_KPQ5A0BK9vI5Ur1NggFuwgqtH2cZ6ef97g89C9_mj6LHlumqjOcsjeYdRYvSrtlPrfsVw31eA2ML1vYWCt7QEg5JdIo54eXTtIeWyyM2fGauA5BhVGfbnXNhnnKd8UNmhV&sig=Cg0ArKJSzDn7ZYQ7w10XEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=86&vt=11&dtpt=85&dett=2&cstd=0&cisv=r20240214.84849&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
DATA 200
OK truncated
/ Frame 443C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b14e5f30f120e756913f52cb3b85aaeee8d904573d324b8b2a5a4c4459c6eb8f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1712834/75654858/ Frame D536 272 KB
79 KB 445ms
35ms Script
application/javascript 54.217.43.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1712834/75654858/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013453133&ias_pubId=pub-9323971679203656&ias_chanId=1&ias_placementId=20921000617&bidurl=https://csgowfire.ru/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0g2o2rrekIJwR60aZqAvlIL
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.217.43.2 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-43-2.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b0aac5418e53b0da2a61a68105edebca907200ba86383c37b144748ae503143a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D536 111 KB
39 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 20:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 20:43:16 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/ Frame D536 12 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjqEyhT5mRwz0T7-pyNDVuhTlClhvf3lSvYjbhdq-GRjCY5_6Z-_Pam09L3FiCUhJpwG5KitFY4NP_aKqXi97sjmPFNfErw6LgaFBsOxK9F_K-oMPcd_6tzOsLo8zsUxWwdtbSkYphfUWs8DDgkv1lxTvqPCsKBEEhdSRTyYlYKNqz2iQ&dbm_d=AKAmf-BYeYlXCP2r-KdvNkTtrHO_M8sbobvxQ2GzgC70tti_-4zlTgPxMpv77Ejo4ITTL4ybBoHcqu8gc5VI6d8r3dkgvxY6Mog2j2On01H2EC9W2FP0Ev2sp6kcp5lu28t8DdcFL18GT-XaU3kYu6JcJocguFWsq1IAf2q5TZ3x57EyqCQsYnc1jvM2iaHx5NrcSjDKGzFkne8AyfS84nM7fTWO7DDUxEKYofiH-qHgjdsxulXPQguOzzTWqPx6JDB1Uk3KCBm0aoBAbAxk3lvF_p98dJv1VrHWEZZ9f23ITF_N4-m68pWnCEKWooCMuWBChL3bhCvnP_0bAuvMsLOJonu3UckjEqONLfHHAv80PFjwMpVHfrX0eGXwyVDXrYbF3jrX-PDApcNXbeIhnRmPDmaDs8-lJ2MbHWK6fCd-XHiW4F0UVGbfE0HzD1G9NOGOv5u8vlwglnKO6hT6p5Vm-MF3CnKgYZFGK0N7hZxrC4hfpqw6cE78UVHoBYRdqR0_HQENFBAESJTx1tnTcwzWEJ-fS7p_oVVIEYnOrKN5hjHJfB3bIYXnoCfMl1mIthNahtKysQDAEig4Lt9ntkRMecm6rJEv6ySYWtWwTx9wt7hz31DeIDVaviAxb32-LXlEMrJwpN_SJiO3hPAl_0tHwF9mn6Dmfv_jivLf01Yv7Qo8SIHVu6g7a_xhzFC1qtE2ZIun0XT7I8JtFikSzGsxDNla1n2iOx7EuHCKEBCSsPjSiRR31a36tNY2JYSutZ3ErZqqxHITfcIV8bzuI1Dk8006cz0AgTK1Dp4Wo1ktm8ueqqjfvqjT29oMzW2b3sckGaWFojZDt5dsRLNCXBKaltp-VIjBqnGN9m6nwfKrTUCoAcIJMFfTsj0-P591j2lAeVIXyKKPbmFpT7laqu5a7PbOR_oCgUG3AnYd0Ta4T9cGHZCcpGbJwWDDFr-5qYbMWE-kI1-WfdKj32xEeYNPKDkm5I_BUQ89AD6ojyCGIIkEwDYESBNv_If2YtXAiaD48zNheKWFjTJT9rnFSCNYLLRFm5TaqNIW8ACcJz7uYnD-4wkfa5Qgwu5B-P0o_3DWfirZAUwlbGEj3D2NxyEtW03melXB9XqXQYyb59LvwNOXN4xMBYQZvEz-4ZfaYxKKNFnEaHTv3PUWGYit0LPtUZMSCNPQfpmd3lCUMfvsLXMtjh0JSdTBORnFuXaQDFoKaIrhxJtw64q4MtN5kPgD4BdgWgOHpB_6U8ckR_HxWwibt0AB8-odBetGhCWAFWYc1JBM4iBvYQ3Mvjss5Ll3SBiOuNjtcyAggtU8gVfZ6YMDeqiBCV0SghRWwV6Rd5a6hvoksH5uZF7g27jX0AM3Jx0APWoiYxSsm5fHsgfynEPnikNhfmtHXvk_clKYLVLvMi_LtqF3ijsP_nJY1MWxLkWVsaR0_Xtqgpq31jMsC3dMoWrbBi2vQBLoPjUHJsqgvExdWOy5BQ0WM8vWFo-i26F62PM8HeMn3eHb5dFDTQjTExDTQofdBldQZndUFtWkFu8nviTLdORx4vxT2bI45XfwwnLNXRtgG6cqd52t9wCP6IzFzYfDBtZiyrhuT3fhI0GEYk41wkhCUnhhY_DcrkumyvWNOcf4jebO-NFo7JgGr46vCr4W_CsXX7nVsUeq3gtc0gO1S2Is65TnhKfDUALW_AJkYp-JNiWkos__Jz6mfyC6w-aGIdJYVG1IB2ptL4jj7sQym0mKfc0LZ7Z6wkLvl6u_7XUK7rMa6axL-OWAYH0eQRJz5OKHDfEROd1GbwCCJArdIq9wYFewxTKXkQBa5DV4CTu9Tt1s3GN6mssjGmEQo_FYM1kM6gHZgK5DCGvyehe0AhL2AE8YjfvdVzpjN7KJYj66z-c1qjErsltlV4poGDzANcjFQUpMhjs3gKf2T725S5C6_2RxMEeB1fY7oQZB1CwE6zSp3EHTg4OxFD7dBsKeZURf3PlwDUGqyCSwNn2weAe7WzrTlEdyJJZuduGKn-3q_MOMsLaCD1jC0KHKYF8vrlw1PwMD-Ty9ixzChgXrOpW88mmuYXzKNxIKFwErx2bxorcTzOe99h05FaH0_DqzZJVy_9VjRJwpUpwWsuEL0qBq1v4MQa5lmxkSkPeu9teHJXwBstyJJ98venWP2bjsMMYP2fk_5KTRX-BNGhhgYjCW431VAOGDBcs5oT3GEVU538cukL1FFOW1UP3Y24ToWWRCjj90WssGVb48pSeEC_WIq_PgrKjzNILDl83RenX80ViysDyNLz3Tbc3_GQaMxNgHfvbMmOMuHOXpvFvzvMMs1nh_AnlpAQw3LvRmRn-bAlmNJVsbfbS8hiX-_HLMemA64A6AlnUkWKtzhrPgK8L3K9Cqnp6vp85Fktoj8kL_ukHQRkG0cdzqYRUIR55IXv7RUizfOgvbtlKhJbQvMPtL1F2_7BKRIxBz97ZQkmAF7qIojbWSdjOpQPp0p0ftTgLE-aqCV6S2400r-xcU52ITOBtdWXVbRWHqoPcN3MSHm3jFDdwsoWQeubkZqjzLpdbmc135wfMGzky5s0gF4Mhaq3XJwekfXGrLIlHgUrwrPD4_fXTJA6GbA8M7zCt2tXq6yWLdXA2WfMzbASJjulqyViDgooC06W6kL19gwMhblspyTNrrXsl8_z25XKWyj7dVnlArjiJuuwJfMa09xCRNWO6eG-9iydY2VJgOmAm0ytDNGl4phDiD-T4yXFl0vZn_tAO_iImXs68wJwKl0nyVl0snk4N8UVJt6fHin_dlPiZuKPP_25mfYng0wmQ6jwDuM8IKlLrW3lVvpKUR5XVfP9MimH3zQwcnErGq-tYmHH598diHs_ZuCSKjlaLepiz7LAVeT8YtXtoPHkFUefsKBJq0gEuQT8JqgAoRSWzYqv5c7nZBlFSAvsH_vpOdVziP7N289Sb5ZOE6ARQC6s20PqlXDALkt617gmkvAKfZYhLHahqb1OW1j1x87E9jxNGcOo7K5xekS3ReEeggGecAiT4zvtXN62BbXW8tQwhWeF9axD_l33oWs4nccefSXXnJfdTS1XlacGUOQndmTKyKkaGoNUKJgghGYz6ZARlcF8e-YAF0pshUPSp6tIuqPPZzNlUEv7kgQu-aI3sVys1lbVSfhHdpJXo3kOoZoGENW7S2e_EGdfkzGG0e3xVKQVpWxhZMj9ydPKZMnIXhVONTiRxFsJ-BABvmkcwiH1DdW_gZwDS1ZaZsGH1CiNLau4clNeylQ-xqJJtHdTaaiwefGC3iaiW7g9SceiC17TJ8MpGSb22-kyKz8BFGFzIk-I7S0mWZ4f8gdwW-HoW98aaJwxG3t70YbqC1NfE9muu4oFAlTJcI6KhqkRkWu6GNEtiFcqG3lZBbZRfCz0RrVWvyV1wVi5Jm87i7abJDgvyFQx_fcmpJl4aJZLQlUTCuaP40lOh8fVvVnZc5NijXl7XHcs0_Odxm5v8uJWymmnEgDqLhSBDUErF1u7u7iJdcJUD48c9Zsbv9ZcH4P7bS7B3PZIucs-iplyB2T2BECnBT0f_FobugNPgh4mVsGzOaLRp9Pn2WhKZvJX2YR4fmuFn29ingUZWRcC4VbBlj8EP5QI4LAcfut3sQbbZWnqGOr0zUPc23U_ndw35h5UEGCjbzaTjK9ArAe1tmDl3_Uq0nHdzOscMZJB_TNVKxSYKMV5uQ_mP3JkRsFcSNmimqZpCpYX42yK8gCvwlQP7KPSinXbkXa2PInZLnl26caCENaoAPXCW6xzin3VyOIltRUrqDCp0ilBnYaBzqIyH4tMkf5_46FO-dd4cvMeitDNyXrdDFbAkr5EmtiRuhecH0kDqHUJLEtnKlvJrV6PQnRbcuRemOHV1jbJo85V1U2EnGsTjma_2zkLaOfeidrDmLU2HClI7dQqCAdHuEB7ki53HXtVmdn3oQ9S7OINdmg6gH-PZEHkNroGbyR8qddMMk8LEtOwVLSHIaYuHUyMN8SLhv0uWVMT_s8k41Le693_aLkrZX29S-gBmyi4GnlbWk30PZ-8BR-tl2pwXBQ4vwIQ&cid=CAQSTwAvHhf_MADGL80BEuS5A87_8Dx7lr_ed-JgwKVMmSCV1qf2wHo5Yfi0gk422n7oUUbMZ_ThNwUnEXGe3fWVR7ubBEaLKbz72azsMSy-J-UYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=18355799182143474000&adk=3430571819&idt=82&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 16:38:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86024
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 29 Feb 2024 16:38:16 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame D536 30 KB
11 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D536 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 443C 0
0 41ms
41ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuYgpcfpP44lppFcRPkX4zn0syHOhJbZXVbmgwBd2gfy10p5-TTGvD1Kfe1M4ZvOy6_XMHMjj0L7LVkhF1-vq6MosX0io1Mk-5z06iLE1LO62Kjwf72G3RV4O6mCjkmITPVl9BeHFCpHerQ2bLDX5S_XaFKTeMxlhVO3hcVfcX4G2umkZ7vm0JGh7CfsU3-vKRj-7GhornKQw_4ZPVO_CgQWP8jtDJNDuaGOjgSudEfGOwnG2NS6mrEI1GXSbLg9BEmY51ozSPe73rPQwD7wABrFaOEDZJZEDRm75hggbW7Fek1HAr15EUhtRAPoB34jWZ47gw7LYrKLV4_OG2NDFPJZBVlQq5F_-JBSTabwZNYWXilU0-9PMHtaNEXUQWlKTQXl6Pln2DP6L3KolWcXxK12bS4PZ59wvZwoeIozQai7gv8mUMcC2NM0ztcvQ3IQquJUI9-fl5ZZUtshYGk1H3IwGkpBNmOrRoXYr19JDEjsrIW3TmLOrdtvPYc0FXKjU7XpHGg8N9MaPa0xIqwSY9_K92kDcVaHVBQS7gdubpc4DHL5Um9FbpNd7B44VEyXN5MsNX4zVS6umlL-SqqLGglBI7DOrzlZjHmTh7uWBINrtWPDQxaAQJfJZkU82KPcpbfN9psSCtPuwk2shexpcvJYddBfvh1Q7F7TnxK0aoFR5fGScavKOxEUBHY5bbHqvqkmZ0fOkFN7T1iIkcybiD7lJf8Qi3BrsolcS-04EN-jzJ-v9HsbIlNoHyVeH1KmhTlzFlauL0e7SPI9SSHVtF-PXhcgaXmW-cDCZK034xfCPGthxiiklK8ggTKaaODmkAMkGtDGiQw0k0qb2Kd3nk0NkzjRmbVLEIlbQMG09A4Xvx4AqmbR4hWCN4KVP4KyzfIFqNgtFbul1jUginCbAQF1bS5xr91gSZuguYvqxre6zg7krvsf9GIFiNV1_npbrSHWpmorE6rzmlAo2_uPlFBuHILbW-ybLzTMWnYAvb_JlIkeE8vLfpS0sfeWnP_KJ1CE-8eEace5a5IQPMb7m2Y7MVpM0DcBu72EEOlVDfc_Fv0r-EKMMD_3pmjHp8G2CW6VybYJR7pXmPJpqoSFPbwfyemV8e0AxPnYZqGv0ucETecRkIb4lXT2viSKK_2HcDhXtTuixgrkr9MaWam05IQZAjRfADvuGJ-3seoIhKHj6_grgE8ycn3I38egKqoRNcBNgbgUG9lzMT2u-LKzBRkTqdtQdpdFhHuMTKQ3wL1p2T5s7K958cxUWBed92lNwPPmrCEVlWBZgYKluaMoEu3P7V5Szl1kgON0jVumaG5l0jD-zuMGWjofzaBqniwPXViwnH1g3jBiAtzFBAZUoMPyY2jbGPO00E9thfdFrTmhry3yf-G4HafAATicBb01cB-fLoNwq_XG8mWi3R0uauQt3qayYh6j8dQNbvlZsJNcZI_gb-M9aYlD9Bz6l0gkboYLrIw0pK5NM32iE5iSA&sai=AMfl-YQx0LkYddzW6Nw-2JVPXmzXTLjp8QW1XpzHypiuOs_soBuaq_-WsLjxYEQYC2nbcMb5eGZXW2E46dqLHLMXSw8R_YYfIiGrkjM5vIJ47nfJANplbA0hH2N6GJ0ssyliFYce76NNkaysI_ybwfluYesJ_I7TrJIUW3XKDQAtMAn06BR7hRNmYdGoEhYnLtz3YPM4eNraluAyYBGI0Xw-9yKvSD9HH85T8UV0KUAMWEfJTjEF3hbMFsi0kiXplsG8fuGvUT4XpXqqWvTE4qBqA69eww6OANb5nd-honVIqw6F0duAslEU0CcEuxqpQnZBtytZ&sig=Cg0ArKJSzN4uM8EX3JDJEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=92&vt=11&dtpt=91&dett=2&cstd=0&cisv=r20240214.66423&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/ Frame DFA6 30 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240214/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A9Vmzb40WoJqhUH-3wRdVV3yeG3JgTRf7T0EhGiLXGe-IU3bQair-8OAAjhuTCqs9-mG9e5c-3kKneHhQcP16yd34UjlVJw0Orw-Qt-NkEoNd1TG4IHrTbsvwQ_CsfYMwKMEJbJxbpsZTxGp_MC0hFQgCb8MnVGHfJWb5z5AFHmBQQ6Us&cry=1&dbm_d=AKAmf-BH6v24h87JME1avfSElptV3F3zJJQ9oX7tgvGeR3uvHgSkO_FBVT40LnP9IGCZKoPYeax3j3CEI2baQe9YkOb_2lxY3OHmyzrwQ3tidok-hSDgDm8cpPS2ISUUReOAjC9OWq6lMUGfNnzAEJxToCXCkaOM0Fr1b_qI4J_Cevjfg_-I5GL6YzAf1D57D97QD8W-FDOdZcasxXwMyz0XIr9KWCQb-Dn57dp7TGPEMzq4MqW1paEaABQ9JvKdIn4WHohIhYI88lLKwDKuJ1wvDGYPeO-FL7575YVar6j7j8R2OEYmALM2kR-62mZkVbc-2cqEH8xi0PMjDp5QLiwgozTNIIDkPHzjqzmryOFVtdCZIWOr5FeI728NXK7Kw68sGQCGOFEeSiLkVswgORjSyz7iBfRzXJhb9vFkS7ySIoUiWUWIn2_PLFz3Icto4a4rnrl4kRZz9z2OrBHlsqGeqJs_IahMQUxVvlTykUOK-etdaZVD_KVbPbNWZV5WejvUh5yDBrZJ1yYUBcbh_LfcKFrGyYAm2ExQ03Q75PUSaprHsgioq1ef6_iH29W7JWv9ngdwgy3P-pqob2wHpK4NzmaROe63Nw5I9gqiS-SpAAIuv6A1E9Pp_gvqNAWwm94-k_eY8lfusq542gOflKeDEIt2M8azTJT8wYQfsJLj8Ug2gftUsyg-G493iPX8XgZnFrWDm22SYjuC34Oo73E7Bfxgt_Z-d2UyppInSjHn2WNoHfUPIC_AxkFm7KbfvpDXNhMRlkQU28jI1yBKHkufiVoS8POriBw2MSfyZfRkg9Z4GlvahG_IIp_Xyh1d3jP0S3IUo7lxYeqZVg4wPV3HvlBWzrlP9Bm_R4R37bGeOzPTZ7aifV8K-sZTvIBO7P6oorsmETvUJ_5UaAJpHbpb9d2NSVHML7U5tTgMQ3N_oy3oAJhkPo_xKPD6JdsWypqlaEaoVYwjdWXZt6HUOoOxJhtjqIu05trr2qF4F5htkev8ZM7hvY26s41Ej4zMuZlQi6sp2131xv5TmdWzIpdnbqaAOYuBdQT_daUE8Th1RKeJ-AUlI1oQUniFsbC6Nb8rrYykZvgF9jV026TzvU_29tXBLxBc065fNsiAV7zlmFE-BESn82Np3baD6NQRbT8SG-X6DoFKraW77sPlzEHzQCfhOtTWHmbu1vXPCTqh2fXfSbUiYwOxuzDsQmHEKKXFBlvp3pcPfgM28Gl25R2JeP_zeF9NFg3nknbb5Ay6GaQj6rXve_P9Y5TnUKab-r4AHdqHtyW5T0OKf-P0HddZV7JmKGkNqARsGrSud0ZD9pxGnCDM91gJESrJxDd8uPuxZS3-toWlhG_UtE_sRQNvHAo-M6Z7q5TnbUFEtuNOc3keObZu3BdLvI-o2EpzDWkp7D1qSwkOWptaeXcAWeiktO_eGYkqb0MCj51BqBRky1VhCYvSo4STkmaRhyMEVjI2OCCpftpHz6Tf9KyM55OY3c4MY0xApm9pwNRM96Im83tkYzn1aJLOi7Jq4u98zpZ_zi1PkukJXMXuSnObiFOpmH7fGntU5GqlfYF7vWgo1O_BjEh7fdG-nghoNjLdcFQBOjps-nUA2v1wDXZ5ACYtCOApqL_F0Y_Xb-vJwt6ywlTTst5D_X8Xtqx6sMUe1ZAwBy012R_RetYCSzfSh0nOeSrakYTbZss0xibBETat8GnRbDJADBM0aUlVZCHMo-vlXN2bm7KbWGwVSe2eSC4WMaUEu0mVIWLadvMwgpOPf-0XDjyzxLGP5p2mhihUb_3PN4B-leLn-rzQl6R1EPCPSMNkjyjizeYfQDdfWOufV9iTzLPl5QeerS8rI3wkiJBO4kzIqlZzxYbVDXQA66shSSJb_gSJ83Z-Ht3UyZPlJk_Bsyuhg6WcyjeXH2uTGA9KgJSji6M8vHxH8eHic6uSKGVm7JijP6fLED1qBpT0QtxYjfchKKAjZHSIyDp97AV21bIMjisXqq0yCjiDzZjGlUu9HZiwWLeixNIFJeFTFpsjV1B77Ik9x6D_96JZpJrxTppiYbttYA6D0n8QN2yuSeIvdh7Ya-rbMVt4rA3OkVNj910b1oXTZEyFNx61V1jHbKYgT_cV6Dk-16qT3ti2PxPPd5xJ-l5Xv_a6h1E-HQPjI8k8L1w_QKcn15GRFNcAUdRLA7JiYPLbJvLyOolyyrobk_haSOG8eTI_SvQ-XzNBZHNiazpeEx6hNC1Z3wNk-lvtDErvLolnylzvH6ciWkW7cRJB71EerRKZV4Bki5AZlL96cPryK4C_9ngKneUc5v5Qcu9SaVIugl_I149-tcIzFWwvqaUNOxUnGRhsypFhRHrc0tz3ggmZoC3agp5V6GJq-SoWKNT8Dre-c4hQ30D7QmlCCW3GSbvoGwgtc9wYk7gqkMxy17uTFJRW45s2_o3KweBTa8Yb-ZLd9ISuER8XTyb5mgFLMFfyBkLHOBsyjxffA5LmLzlpY2vvQxmkhxbFkXDzkmpT-8VrsZWdJfEMviHgz5mn8cqo7VznGpzlOV9fasggAjRAIqaI9L74bYyTHYsPejgpm8ixcMUgpGDnk3spibiQuhTIMRqT41zoqWiXTmjiwY9fTo-5lz0RIugmiTtRIkeY94SClORTSC5xdaxwiOI0p1PieGQdhywrPinbG-u7hn5x4vMX3127fU75szljoMusTdeH_5h0bYHjM3C9ha2lGIn-CsOj0tpqhiuDrC4HXxwESQPkSE1jWoB5DFP-BvjJd0wodeDnt4j3zDRlw8rPT1zhWMz8z-rGsyq9lsmhFgpY0_CNXfuVHC1pCZ7JhjC_XYiVO7CvBYpDx5Wkz-CSoXtaA1xZ9mJg1OGCrmpLAB0OhjR4YtTBEtUBP4HJOIb62QmNBALvUVKHEEBPB3F0nwH4F7OW1XwfTCVqTDoCdH_pqBP8ueWujZEQOmx81g1HIcAkU_yldIlBqvbFPVwYj0Ebbpl2NkwshfFBYq8PTNaLQKlOAVa7Wq0Kt7OqvBfbjVs9SQPWvh15uIzxRs6WnBHUpAcysI0xlESpHlottQVHxPp4Iu-iL-m_PKRC5HCVdQ5WII-pHm7Mj6JEB6XEzLO9b0gwK2GcliuOILh1XL_GweB7w3ES6rYJQXoLuqT7foUEP8OnDOeYtiZ6Xy_r5w8QyDnJaCZNdrLumqiNdBVwoH3PKnx4p7r6dkCvwFTSdDXcH6kniGVPAKGXpWQqID6rlLap0dgAWjqmpEh8LIZ-uSHuXgSBpGtH5tmD9zV2Jm3rv9JcM_bIK66CJYRKMot7H7_1PM2TaedVv12qzGggw2KFliAhXDTJ57EIHa3lzGVO0zRZA5oTe6GpUOoj7Pu3lRCbXpA_mImUqyaDIVMM4m6hno_xyxwLrbYdXgaCBdkPTnxrFAOXZmSXrpqjlj2Re9lErSRqUr_-femdpi2BaF-VbVrdbq9rwny8Gh8MDKg1SpVx0GVNKD0rctAOQFrHegrcheCqNqUhOghMYqd0ZVJbpc3hestV_ZJumWmXSVwrvWMBo5BFA8NaU-FhOyktlr2UsxZfUHRmQ2Cz-uJRQ1t8cDOzDZwBS-LNvo14PdQt_liINjA9hDha0VGDyT9l-MGft2Ds6aIxzdrdHC3bqQIZemfiILf0jnoXeN-nmDaIa1jD4FPTI3hIfL6gK3cEYMGm4U7MREjDddA5O0OlXjTroQowfagGzvUCv_7Fy_AG1phOvhXq6Iy_ZplR9_bfUxOhTacaa7FE57tIoBweUprwirWhB5h6Q3QR6PraTo_4gfRi1c4tPNVJTUHhE7ee_QcqGG-7AbAwqg9aaPuiXUih7cgd-s2JhZcj9RJ-rk26bIck76D4jW_MMQupWy-2IM8aSDvRFDyCyXmVzC5AidtAk5nlxqwOhvsZHrwuHwmvFDFC7sHyY0ebatw-NDGk466GKl7RWfoLGJk-9Ip3EBNE47bQeqSC52qQK6Z1cr3loFCT43JQMS2PZTbdmsuMwGrphoWicGlfLFaxbESTzjcIdort4vrRUu1EXPsTCf-cf6D24FKPKJjJiVDl3c0Ubgg7CZmcDx8gu0wzxOuk7Y55AAXWtV9oNcM6VNTARutcI4-O0X_iIX4pdm6ZP4D6wELgO4o572SJvyAnzqEicgQMWocaLKlEvAgDVlmV8CQbzE0ZXgFPfW-BngNGz6Xgjh9zwnXI3BZt5_pkr8kFFJp_HnzewEKJ7roPS8fG6dUa73Rm63U4m8q7LQ&cid=CAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Fcsgowfire.ru%2F&ds=l&xdt=1&iif=1&cor=768214845007660000&adk=1033480540&idt=57&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

719314f680a79defc6c02a7dbaff63da48911cbf418614226bde044fb02e065d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:24:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11551
x-xss-protection: 0
server: cafe
etag: 12710720872123804752
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Mar 2024 16:24:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DFA6 41 KB
14 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 09:07:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285856
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 09:07:44 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDcwNzc2NgogIHNlcnZlcl9pcDogMTM0MDcwMDgyCiAgcHJvY2Vzc19pZDogMzEwMzkwMDMyOQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame DFA6 0
22 B 41ms
41ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwODEwMTEyMDcwNzc2NgogIHNlcnZlcl9pcDogMTM0MDcwMDgyCiAgcHJvY2Vzc19pZDogMzEwMzkwMDMyOQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNjQyMzQ1NTkxNjk1MjEyNTY3OQpkZWJ1Z19rZXk6IDkwNjk4NDQwOTUxOTg0NTYyOTYKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAyLTE2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNApkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3Cg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x2692c72fb10c5bb00000000000000000","13":"0x6201d4644b1748870000000000000000","14":"0xa6317064f966e1be0000000000000000","15":"0xa3e82bc22a763eb30000000000000000"},"debug_key":"9069844095198456296","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"16423455916952125679"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E0BC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

29ms
29ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
expires: Fri, 16 Feb 2024 16:32:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:00 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame FFDE 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame DFA6 11 KB
4 KB 39ms
12ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708101119935792&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTWy3_43PZfCOOarW7OsP2_aqmAmm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObhICABKoElQJP0Dr9Yf5RcssEKITQhkeaolaNKUZcrlnBSa0PJ7eLyliZ8SJZz5IMftCl33SKCf0np6aZTZGj0ogQFDKRi_uFY057gOU2JojKM6Q7YnH-QZ1vSOuyiLfbNzOmxSfKazTKAiABRYRyxW4KNT8kqGzaauUvq_j61GyDjT6Q-Aj7Qn5M-_XPg37_pq8F9ZSKTffJocbRLGKie4XTS2DJs3ZRxFagpwFYCuwhYzh3TuZu5EHJKLxQ_Qbai-imOEj9x1UyroTgyIGQnjAJm9vIAm4Irc7O9tzet3_Ver92BLDfYwJfbj_wZmsT2ZZBajkvrZrNd4kyG483u81y_hC5OQCfgAiOL2HS_dgKudjUC4hzkIeSR1S_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljw8fHDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ%26sig%3DAOD64_2UmzPzXVIJLFsSiIscX39mK4qcxQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPMlLD4ziTWuJ5z7gxrWzqXl2CJ7Zyd8K72cP3mOOfOMB4Fg2ErT4ZumUwJ1f1D15MEHFhVe0zN6Z4p3mPXhonU3cCXYfn7FXFlEMeZLSME3N5gUSc5S7lXvoWeQ1JZRGU1aij3RMOytaQH308rjTXLRkzBA4_GWvuxe1OxTAZAdJlMww%26cry%3D1%26dbm_d%3DAKAmf-ALbY0BCdcyRXGctW4jzKEzW8XpIH2x2VNIxgiulzodxnFurvAcVTCfjmr-m1QN3--pEL64P2ijidiaZKFqoObUhHrCGO4cOpspjBL-7OYMfglOxdwgTQ-Xxo1MpwRrUZQgAl5D8myVsgzOobV8XhNl9JcyXiDA4u1V1QfMwe1ClmbmulwdSO1U07T_6MYJzOCmLczRg-BJmyDZJR4SHao8iMk6fqFmVrmc_WkPuDzpsSSgPJzQqKu1xXW9MwJER9mBWBNsPtqYLWULuSWDGJ5aO76893rE_8wxRrmRq5LLlPVxzrCCAmUbXb9AK2UfaTV5aazaCsodF4nycyXq7vjfVNrV0ST_SpRxE2BWjISHInAtM9gGtQBZAUGyDgrueZoRnA16YkyvQfOZRLmAoI0xp35xI2x3hU76_v9idqnKauWmNOJFNJXGQcC2fUhczHAYWLJEEtf7vs1gdIsts3cUQrAElfJCoWVQvjieIKF1jcuDGtY3N3KM5mz-Uodgw6Z8DZNUOjBcJbikFVWe14dgPYCXy7qdiiOaV_rHtx2KQkKCcfs%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: bb11cd2956b74bb2ee71aa7e40589745aa6d3767293f213e27b436254c9e1d97

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4215
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame 6980 51 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:39:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 244346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:39:34 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame E016 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5909 38 KB
13 KB 8ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900010.redintelligence.net/ Frame 2961 613 B
936 B 140ms
93ms Script
application/x-javascript 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7b90dda751&subid=&uid=b269bc3574f088d9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCyvJe_43PZbTEON2Ps8IPgu-X0Aqm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0LKti4zOx8rRdh4VawgPocMunoZXzJ2_HWuh_ouJRtCUdswQTHTgAZH2b74JWGtsV2Hyo24NTVaPX9ZkbJIRnbsvQ8joAvERNtX6L7kzzW6VS_7mjebbWZw7YGUXf68W7Yt13IDFDoxB01CE8tJCceOMZ5EG4Dv5S8MO4IODAmIxBFhtVgr0pOVkX908OeF3ELJrw75fJnDlygmSHPMvmoYu6kyhxP9jy7CUZkxOJzOTRM8-AF7K1grj3JsdHQl8FuYQnhzK2Ypf6vCcbp6Kq5vQ6kef9AJ5QuwFHtFqiK6YDQMHyJ0ZI5hUl0mCwBEB97Kx-cc_qwm9eKYwpTktkIs_Zpv6iw0K2TdvH7zLwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljNo_HDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ%26sig%3DAOD64_1-Hk9V1IUruPcYt9nZJXt8kExzrA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Co7_H40pnwE8avewPHokHcFUyi-zjtfJmtz7rIQg5dMgMlDGBCEgKu3s3GNgJJeoKGjakj8yz2jdms9SCUl0q5FWvRm7HWSPqmCBoHMHkG2DUdh1RCOH7MZMT6h_IXz29In1gxH_1ix7yPNQzOTXgfjvAGCWC-yZb0ZRVv0KiblWzi-iY%26cry%3D1%26dbm_d%3DAKAmf-B2ymos0AmDGEcPYSBemv_qhrDQv2jdJu6iH5vCdcOmmgMOjrZnKS7GeFVgitXFtjUKpHHWWlKVOGWOQt31utRJ9fyqldHxrRW07-YkJRLglcQEG3MSwhXgQs2bs3PowZOiQ3AuJdrJMy1SzFGfGMIyzi-9q1t_TW_CQOuxVODeL_tHu4hSy7GOAXzllnBxknZAlEjsESNsoocgQ7c5aoKxzJ1-uV3k3-vfcSJU-4ZEbX_JqoTWdmV_evxKgzscTSVoy6f6bAlzQKWFnToNuSvKsHUcJSirHUsOMpotb0zjFa6OAAt5sP3IWus9FSY3rNDPQExKXakR43dgFwZXLF2l9nM_4WQAaXJ4BBpOJHnlhYpOKiZxU-9GUeHYdafQyNeT5k1ITm-eUnZScmu5ZbU1IlgCj2BcG0fQJrqNLJkOPnBAnCbDi80sjG82JVx-_fLQ-uiWtzvu3K_ArbKCaLLK1swEtwSh511A3n5QaZzE4lUsEfpD-D_Iz5C0M-nCS65bh8mDV_7IGmps8SW18sNO5pibn7UwOTIAPZuCQrQgvV_7gtM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=3653088913749&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708101119926260&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCyvJe_43PZbTEON2Ps8IPgu-X0Aqm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0LKti4zOx8rRdh4VawgPocMunoZXzJ2_HWuh_ouJRtCUdswQTHTgAZH2b74JWGtsV2Hyo24NTVaPX9ZkbJIRnbsvQ8joAvERNtX6L7kzzW6VS_7mjebbWZw7YGUXf68W7Yt13IDFDoxB01CE8tJCceOMZ5EG4Dv5S8MO4IODAmIxBFhtVgr0pOVkX908OeF3ELJrw75fJnDlygmSHPMvmoYu6kyhxP9jy7CUZkxOJzOTRM8-AF7K1grj3JsdHQl8FuYQnhzK2Ypf6vCcbp6Kq5vQ6kef9AJ5QuwFHtFqiK6YDQMHyJ0ZI5hUl0mCwBEB97Kx-cc_qwm9eKYwpTktkIs_Zpv6iw0K2TdvH7zLwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljNo_HDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ%26sig%3DAOD64_1-Hk9V1IUruPcYt9nZJXt8kExzrA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Co7_H40pnwE8avewPHokHcFUyi-zjtfJmtz7rIQg5dMgMlDGBCEgKu3s3GNgJJeoKGjakj8yz2jdms9SCUl0q5FWvRm7HWSPqmCBoHMHkG2DUdh1RCOH7MZMT6h_IXz29In1gxH_1ix7yPNQzOTXgfjvAGCWC-yZb0ZRVv0KiblWzi-iY%26cry%3D1%26dbm_d%3DAKAmf-B2ymos0AmDGEcPYSBemv_qhrDQv2jdJu6iH5vCdcOmmgMOjrZnKS7GeFVgitXFtjUKpHHWWlKVOGWOQt31utRJ9fyqldHxrRW07-YkJRLglcQEG3MSwhXgQs2bs3PowZOiQ3AuJdrJMy1SzFGfGMIyzi-9q1t_TW_CQOuxVODeL_tHu4hSy7GOAXzllnBxknZAlEjsESNsoocgQ7c5aoKxzJ1-uV3k3-vfcSJU-4ZEbX_JqoTWdmV_evxKgzscTSVoy6f6bAlzQKWFnToNuSvKsHUcJSirHUsOMpotb0zjFa6OAAt5sP3IWus9FSY3rNDPQExKXakR43dgFwZXLF2l9nM_4WQAaXJ4BBpOJHnlhYpOKiZxU-9GUeHYdafQyNeT5k1ITm-eUnZScmu5ZbU1IlgCj2BcG0fQJrqNLJkOPnBAnCbDi80sjG82JVx-_fLQ-uiWtzvu3K_ArbKCaLLK1swEtwSh511A3n5QaZzE4lUsEfpD-D_Iz5C0M-nCS65bh8mDV_7IGmps8SW18sNO5pibn7UwOTIAPZuCQrQgvV_7gtM%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: cf22255345135b459535be8d71dbee396e43977b1e1077fe15196460ba4f24db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 13762700138580904444554012602010
Connection: close
Content-Length: 330
Expires: Fri, 16 Feb 2024 16:32:00 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame BFB1 38 KB
13 KB 9ms
9ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900016.redintelligence.net/ Frame 44B9 613 B
936 B 159ms
114ms Script
application/x-javascript 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=d44a242ffa&subid=&uid=9b33dda5b97fd2a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCocIf_43PZd7WOfeLs8IPzrq4uA7r0sGhaZ3x3vTFD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0Her24VIBIaUEDWXsvKsO-j5YZll5kXev_UJSxFup00DmiObNLBjxDUiNA1bOD9yiJAtfqrbXioVdOFYFv2Iav7fWCTKFSrbWFbB84mutExYx0rxV8pN2t12MyhC40BBFKovXLN_fLfpcS3PvegxjtzA1yBfzpRbe9wngwLlStDNOK-_AAX4nnBw2eWw9fmRJeELWy75rxyaj7wWg-J66Y3BSTXlHoO0E93Vodlz4ydgHKdT8s_o3X9yDBPKd6JuS87aUPJ_alYPfpkqEDG-lDWexFr6eNlqr0KnVWhKqi6Sske030Bw9uucR188CCSScWn4lngJvmuUlSp0VtejqmwAr3w_JsCl01EZRbD0BmaN6Bj8wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliUqPLDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ%26sig%3DAOD64_08bAxOP5KNznc1wKtjtfAOmMiQ8A%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DNOghcbn8S8wfoQBdLS0kYjBKXUJ00Z4bN7iRkn5A-Zt1cgmAOyJHPWtTTH461_sLf0H9rH56VvssPXmyY44rlG3SM35HFm7wdWM2iDuaR2l4hlhQCSZ4scw92m7YMr5IoW7TAsekcain72m9jQJm2r8T9FsC-X51FnJ9PySA5lF2hnlY%26cry%3D1%26dbm_d%3DAKAmf-A3zSLfbP5DM360iAJqy1nHEWmDLa7ZmIacJx2OF_8R_wvM8G_8rKuCEISDkBJDI_eILe70VlRM-U7CBpPEY8Au1km467Y3YtGGdaP5u83VkbDdvZ7O_ELv2nnNfrMxQJw2_RuMyD7jrJMDJRcjKpC7llymf6ZVjspLrSp8ubJlLiVDYfg0puBBex4kgFG_QRsaiy1vo5uU_SImiaQXAdfQAE8BqXy3kdWFB3XH-ukD9ArMRMcphaDZFbK9BDvH9noJjSmMWy2jACBsDvGMbQ6L7YiGYtJwIRPe831vbAGW25avGmlotzA9UoT-RHH33HQW9P-WsLJ9mAAs-hk4h512J5o-Atx40xTTURps1QlqA9IrWPISWW9udcp-R2bdmm54um-p1BCEIs_3ftvVSAJQ9VYo7nV9mWYG2cGYQIJgxSnosBiRdnnvTuDIasMUD608-Gy0ofBs3Y8kVO0yDlKY20bwMI8ZL2zZHgKyZr4WzBeA4x3ED_YxYKAZkousBTct21bV6jZEO2AKlODm8rSCIGV_a474J_AVLm8QedYmINafRO0%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=3286137046736&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/okg862ss9p0j?subid=&gdpr=&gdpr_consent=&rnd=1708101119944990&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCocIf_43PZd7WOfeLs8IPzrq4uA7r0sGhaZ3x3vTFD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0Her24VIBIaUEDWXsvKsO-j5YZll5kXev_UJSxFup00DmiObNLBjxDUiNA1bOD9yiJAtfqrbXioVdOFYFv2Iav7fWCTKFSrbWFbB84mutExYx0rxV8pN2t12MyhC40BBFKovXLN_fLfpcS3PvegxjtzA1yBfzpRbe9wngwLlStDNOK-_AAX4nnBw2eWw9fmRJeELWy75rxyaj7wWg-J66Y3BSTXlHoO0E93Vodlz4ydgHKdT8s_o3X9yDBPKd6JuS87aUPJ_alYPfpkqEDG-lDWexFr6eNlqr0KnVWhKqi6Sske030Bw9uucR188CCSScWn4lngJvmuUlSp0VtejqmwAr3w_JsCl01EZRbD0BmaN6Bj8wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliUqPLDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ%26sig%3DAOD64_08bAxOP5KNznc1wKtjtfAOmMiQ8A%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DNOghcbn8S8wfoQBdLS0kYjBKXUJ00Z4bN7iRkn5A-Zt1cgmAOyJHPWtTTH461_sLf0H9rH56VvssPXmyY44rlG3SM35HFm7wdWM2iDuaR2l4hlhQCSZ4scw92m7YMr5IoW7TAsekcain72m9jQJm2r8T9FsC-X51FnJ9PySA5lF2hnlY%26cry%3D1%26dbm_d%3DAKAmf-A3zSLfbP5DM360iAJqy1nHEWmDLa7ZmIacJx2OF_8R_wvM8G_8rKuCEISDkBJDI_eILe70VlRM-U7CBpPEY8Au1km467Y3YtGGdaP5u83VkbDdvZ7O_ELv2nnNfrMxQJw2_RuMyD7jrJMDJRcjKpC7llymf6ZVjspLrSp8ubJlLiVDYfg0puBBex4kgFG_QRsaiy1vo5uU_SImiaQXAdfQAE8BqXy3kdWFB3XH-ukD9ArMRMcphaDZFbK9BDvH9noJjSmMWy2jACBsDvGMbQ6L7YiGYtJwIRPe831vbAGW25avGmlotzA9UoT-RHH33HQW9P-WsLJ9mAAs-hk4h512J5o-Atx40xTTURps1QlqA9IrWPISWW9udcp-R2bdmm54um-p1BCEIs_3ftvVSAJQ9VYo7nV9mWYG2cGYQIJgxSnosBiRdnnvTuDIasMUD608-Gy0ofBs3Y8kVO0yDlKY20bwMI8ZL2zZHgKyZr4WzBeA4x3ED_YxYKAZkousBTct21bV6jZEO2AKlODm8rSCIGV_a474J_AVLm8QedYmINafRO0%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 50794c516d0d858c023e465edc9249dd79b45f3877d3663193d6634ec8066d30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:32:00 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 68380300153219504444544012602016
Connection: close
Content-Length: 330
Expires: Fri, 16 Feb 2024 16:32:00 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A198 38 KB
13 KB 9ms
8ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9494 51 KB
19 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:39:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 244346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:39:34 GMT

GET
H2 200 pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ Frame DA58 8 KB
8 KB 49ms
11ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,600,500|Roboto+Condensed:regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:55:25 GMT
x-content-type-options: nosniff
age: 286595
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7840
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:51:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 08:55:25 GMT

GET
H2 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ Frame DA58 8 KB
8 KB 46ms
9ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,600,500|Roboto+Condensed:regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 22:10:19 GMT
x-content-type-options: nosniff
age: 66101
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8000
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:59:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Feb 2025 22:10:19 GMT

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ Frame DA58 8 KB
8 KB 45ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:300,600,500|Roboto+Condensed:regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 08:55:56 GMT
x-content-type-options: nosniff
age: 286564
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 08:55:56 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3177 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15510786087093693089/ Frame FD16 272 KB
43 KB 8ms
8ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1932dc391ee766f3c87ba70aec360da6fb705f94457ba013420ef216efbb8e8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 199491
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 43856
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 09:07:09 GMT
expires: Thu, 13 Feb 2025 09:07:09 GMT
last-modified: Wed, 11 Oct 2023 10:02:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7B44 0
0 48ms
48ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv1RGA1BE1tJs62cfNeuTdhEefdIGiyHdYRjnf0yqkFutM1kVLrVrMsvAjuyRT85QsGDerbKlps6rlpfXg-aGxrAObY6cBrka8uNlUEmfcJVmp7ZDySWl2y0q3XDBidq1QV02B_bu1xw5n8dm1nNFguFPVH3D2rLNpQm4WueMVTzFkUqZ6PeRcsGoq8s5sNmWc7MRzAIBCg9u8X9BRxrxbKADgyeAvZOwzdMWVHwDnOA550d0cq_KZTDBT8bnQJR8F76aOqmwD4neejPbzO77N3sOeqawA5N26f8FjflrnVO4f-h6N37sOAJ0MFCEAIOu3DISgPOl8yXbNzDWg7KjDy1h0wBX7XnjQbHOSaIQjMtHYYTTsntzeutblfA2AzHt__XEDcziF51IkWQzFPU347qRn2i6f34YZG8G-9KB8FHwqauGv90b7bwiJty2ftfD9ZptiyLGpEkur6xdlxnyoTVHuMK9nmlpYS7f0guzoIMOm-5yVAFrWIa-CgrNWIDwivMCYKQPDbbPA5s1xsLYqXIW80H6IJBN6U6LfDiQBqU_fSUnriu292_Kx3eJXQvpeWjF-KWJDROz4WqZiKIu1rQJZPbjEDm7oI446v5coYkBqPTQuTFOuZohuXt5WfBBXAT54TD-L_-4VTBp8hEbrNCFshsvpKPXX-CWPo88nM06vrW7AbZh1agF3LHzb7tL9z7oiZRQx6jH4Gx7seQF-0cfwuuW1lNrNRnUUuTtN3JZSQKxTTg2RGQL0ZO6-FVQkeQPa9429rnaNwbxw-Kvwchwgk-oj2894kiTE7iLYSy-1N7wFy3rLvwlDek6zGhp7zwZp-DS7fbKrCWbsHloJGcK9xWLDAAPDjv06Ts0ROCMRr8fHPVQUfpOJ39Z2K-osEtMLWNz1M5L9mP_Yu5KDRJAJ2-78V5MgXBhh2foU1dPGYerdZsr70tojzLSlNBbfeCh8UjcH6YpMsKgdFZCfN2zNACF08j5BpoEzKugm3Cb7MH_6h_koCr-pKzP0V5XxHlsv2IEtw4Ns_Sp5NvWojXmNZjFn5RjgQdxRlNibWLi09mFg6dK_6kahSC6EBs7zjC40z51BDLq106GmY61g7xDwzBTVGGB1GrrEPnnP5YutUNKIs_kdy64P5JzFNmKUnNl3mhkAjuETXueCU-rCmajBa58Ntv0DeSJQleWQ6MPQngEbuUtfyPKNKwmHrJLDZlNbqJ6jO7Jgs1T8HM8H9SM_LRKgD8a2zBCvWLqo8PbxUf6-SB_nQ6LYGL5dM0H-2SaThVoIUM1rinNTYb6jOnMK80aMBnMCqfFzbx4kE_UVXAgqIxjKjqoH0q5jEWch7V-zOQvFGx2tTcAI0V-KzcSORnHZJNkVLp-J6TCMicAd_amSbYFGq3OFJGVhG4h76JFWHKiUltqDz7kT0HWhKtwe-IQ&sai=AMfl-YRfP7hPPclTzBqDtJqIzfsczSKaP7ZDFQ7GkPUVDHg7UOo7S6qUKvc8nlh6xld0GM2sqv4vEpEPSwVQMGU1f7e9WlZwpnOmLUW5XezAm9w38Dz9-4z6009Na1Ip8nH7nSm_ul8Ui5_LP6xUTlfm_yzBXJVn6gM3PlcUQowsTt6gEsQCDbGNJKZVLX9t_BQUeX2k3wuoy8Py4h-rlzFcORZjgfuBbrMFJk-XuZK11IDz5eeiRqUBGhqv7cDAeO2wKNoSxKkIiYEmB_stLT2lBEaj9TymNq38P2MmckKk_nM4uEPY6umUJtmD9QcWPrdcJss&sig=Cg0ArKJSzHZffD5W7FLEEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=190&cbvp=1&cstd=189&cisv=r20240214.43935&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:00 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 091F 38 KB
13 KB 17ms
16ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7AC2 38 KB
13 KB 15ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15510786087093693089/ Frame 81ED 272 KB
43 KB 9ms
6ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1932dc391ee766f3c87ba70aec360da6fb705f94457ba013420ef216efbb8e8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 199491
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 43856
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 14 Feb 2024 09:07:09 GMT
expires: Thu, 13 Feb 2025 09:07:09 GMT
last-modified: Wed, 11 Oct 2023 10:02:14 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D536 0
0 52ms
49ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvioUDzseN5-JHPxlJY-80L-lNsLl2hOjEbYg1VfQRDnENj_LCpvcBjEAK1NqYdZA-YUDCgio9YCX7rZNnEUKHg4YRY2_UIWoZ5SNjTtY_yjpdYfTAnpyVOdM2I9eb0bIAoBQ9_mS18VpzWgt4qjVeeg9USlnr2Zciji8bxY65vLBNI_-ISUhyz8edxRR5WFY1D4bGf1Q089qLX49N8isluT1L6n5QZtECKwOx3NcLEBBpu0ZMlPxKt5DZsk2XxDZtHl5WvgU8D5QQdwqf4jrJTqaHjUYS5qSs5acObj8VAQCL5uRp-4H4J_EskF1pk7ZtJA8lBJUHHtENl43KihY6ykzkR4sdDapzyU-yuBR9Is_jxK0LQhSncj95xUH1Z37S1Yr9YjAdoBGmXgFIVlqPaVOtK22XmDKxEPQA7OD87jf1DfnmNVuwLS3eBn8gbDzJCW5id7SBua1e-jbrkqZFFNUwjMGNbRtrQ4PAcRDzTcl4xtD3c2xFq5qHgD8AmKD2fg-FTjQWDag1tYdJKYS9Xc0NRWDfOHsGzcVpEop9sOWKQVmcPS92loY2aZ4zTjrgILVNuGsw6SDevxc1o6R-SdWduzT6224Jq76NgFS9bmaFdQHD90dM-GGYr1gcldOz7NS50KDm4dJw4nrj12zL60n_Bg7FuCStGnPsoFLY6qRO6vhT-oOvlT6gxKG1zFmVzTtJl0S8VQ5W1TN-7YZftvTTTEuUC_JR0HaRzxk-FoW-Cj-MO0vz4yLN0LKxuMrvDvmXklwPJbfCxNMeBTql2XgmkcaqfBwQY9f1qinsxZZv-QnaAlp30NIKKq71OYB6fqUkhji3lPm9Hvscis-BOckigGQtZX7EEpPZiqLnrjPQdwcb2_jlKUu1zGiqFiVsga4RgIbNn7XDQ1G7Q4KXBVqSoTEmTBn3NkFFzpn5zT9l6CD_E23okmlegd_iBOEqUlg_NxFYAWwa9s_wNuPKwnzYRpoW95pyAef6D3TT2sE8-bvdM21DeBUQmHGorP7ZCFsk8v0sRAWYUem4z7wBhrB0Sr_Ha6r0EVsMouM4_8TgULGhwQJHUpWoX9xmxNNlq7qWpxPiIXlIzvAL5bngz56XVYQFNZYwyMXw6ducqTwMJ1wVbb5mzIUzcIddXIqukDjLnFdMsq3uJLbfthZplEZi0deqamLZJoTJMgx5oktRDr8eAlhxZC61Yd7Yfn1hcuXKhsXWgPYPguS7SZqhKSGbuShPC9iC7x096kQhHLrrsTtP21WRV-KNNlDLCU0kPn6ZvDxb_GulpUzT7SJgdGdW4BbmFc5jzksJFCChm_2dfzof5HszxMkpBiUUk8q5f46pRxGYkoUb1RYEU3NKeg4470HZhwOFJWAfI2eOJEq8PKchH0kZrJ7O8sj0MNhoIMKjnGw6diyPGHiHQHBdm93JuRg&sai=AMfl-YQOvmDdZqsMNOx9snzbGZPGPYuB8KD2lZObAxQlPFr_m-DjaE21G3BO7uN_XOZSnyP_itN3MBqhMeegCCtDejgRHgu1y0Qdrpev_H-czbl5LmnlZYCmeFD59aa3OfOYN_BKEFdXc6IndPKwl2KGzv27gVnnaplzEiZ1dNIY2nRL9EWoCMKWi7IblwIQd1E-qNoe7OxNHV2L0uoZnHf0ODRjfhAZWZqSPGDdPQYfHoMkSitoh17vPCdnbbaMYZgRcpZUxrjf9Xa6sKlfRmda0UsjtDhNHWw6ntCgRXGAR4RXdW-KNgskPGkVhD7y2QjGwHE&sig=Cg0ArKJSzN68tAoFCGDZEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=127&cbvp=1&cstd=126&cisv=r20240214.42795&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 16 Feb 2024 16:32:01 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame AFEB 38 KB
13 KB 11ms
10ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 285681
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Feb 2024 09:10:39 GMT
expires: Wed, 12 Feb 2025 09:10:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame FD16 32 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 17:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82626
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 17:34:55 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 81ED 32 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15510786087093693089/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 17:34:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82626
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 16 Feb 2024 17:34:55 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame F05C 0
0 41ms
41ms Fetch
image/gif 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssQaJ4GhPXcpq5Wgs9PFu28FpmaOiRgH22ds2eaKVdBxgJ13fH236rzDoF_COTk0CT9vEzBFzahJvnzTH4NRpbFtLyLjUTMtOyfGHqRa-fYKxkBe3Mz-JWNJqdHhxVfQYMojyvSmC6LSWFSrqFAojB3aIV4ZpN7xJgOJ_VZkUENoy-WsVLpoTTdB2NT00QBOZ6Efr71WGRKrXj770UfwROcZVwlNB2gbx4yDf142vDZ13kvbFnBZvnnNGl29l-u6KPvXOBkTZN7tVcPVm60yf9q3XOYvA1k59HCeIy9xQJErFf6K1qmd2SN1YYcmisdSKOgZq7GgYYhI6JO9rfBJSfqaFV01q6o3HxIUhimtp1S1MxZ-K-pJB_YCZ-mcdAFsEcc92AscFTDacDunuGe-AVPnaJatrFBjroqHZ00gmw8MakYvgo12PWWQXgxveJ7JYCTJJfoQiw5UMGroLF4Q9Q-vrjb9VgMGkvxuHjVNYi_47BbYTqf8Htpl0CwcYIk1RQVv5iLBWhtniDDHwngj_3PlINJQYPdDYNLNLR77ACbNvytQr1x8Xx02KBLo0K_0m-vsOvhEJDXBSHAH6ipvBzKlWFHt98NQqFd7Z4xccFj2R1YY6XDEslv0ZZ8gNkedwfZ3Zs6K_NCcQfjU4mt7u-DndGPJ7fGGseXKy7JsmUdj2KIxekZlgz9fEIhE0jdhRW8PQiVPdkdGcekXEM82ar-WlBOp55jk2W6KUO1lIr5SLFCbe1KgC7jfh6BATCH_8TGQhFdHkJdW45XMDESgiG70eCftqXkYCxj2j8Lf23HpCVI7e7On0C9qOUIwqbFa4hR59XJx6e8xTY_KXXLFNz0viokyNlB5i9v-7YtM9hztRM5H5WkocUXBy2b4-WDYvWHkFf0y8LxU-hLhWZTudxKG5V6Akasbgr_TF320CQnk1TmFJOSshYAny1yNsqC7XBIHQ7avoFvolgwB6Qp37FHxGqSOuhnXVEmEjg1LZDSa65-qwQlmLHOqOCtZdxux2FOBfJfB-0JJKk_AzJpuG8HOVcfGwFbyHQLIFAWjEoZaZfHWYth4VJexw6hQTNAXc8DjyBHaw-mW5Ai9nFcuqDGqUtCuggcslJE4vTTgIRJb-M57c8oGNuxkgu3CHo1BG5fyw5JV2Exr_rsoTnAwYdJAl1hyJPXnxAi-FUgf8zS-qfXoffZOBHUqUmaMSoj4I-7_x7z5jSkPbYLkV99iV5kDvQDG2u20B338XZwBAL2_WFObxk2xQk7yoYw3cKGjzlyQu5wLQUanmSLErU3Mezu7p91Hvt8rCQme6ddvZiy-vsOsk5Gz_yOvD9fWPBUXzbb0gXW_vmLLnKmbKBZDqnjqF74W2zCm5Hep7tdVJp2QxlFSo_z7aeCU9jj5jsqBNM0mpOVXuoz34ujrWCcanZc7lbK&sai=AMfl-YSo_73nF0esFSSDoBFFYTSxpPlpUooisARZz708Dx3U_vRUkmr5m2ALdmchLgmp4erBMUkVbPPRNwfeGNzA5kQZ8_m--WlYy4uBruOFuEV7iYmcW0U6L-buX-Hi6Yu83iGrvylorg0OLPhPyYYuPQZtr_J52CI6Ad3wjR5sZ8jhzHkYJyypGz-KYA7D20kGKtnmZP8KiIu_QKSq4wE0D1g9-ufp6FufRdMU4ZBmWpFD6jvARMJgD794RI_Zm3QI_kjwoGPQK4MjnyvYTZ--t-ba3iiWZnx9Ufw5OhYcY1ZAnsC7RNeRHFpXAIk2pLbFyz-M8fGvVUQQCQoaoKBn8dPJs9ei3PUQ3720WRnw_kUoCdrGvOxyCzDp776t5FuW5PzCkv4FHI_ynnix_tfZlUfBjd4S_gcJVafdjt3V9juxXDCG5bNl6VKIe3t0KVdRwkjFWLR8F8H7c8xYJDp5opCTzRsF7LN1CQJv3X91G3WhqV1X-DsgMhv6eSU890gx6FRni1MH0PfB&sig=Cg0ArKJSzFn75TzaCGtFEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9kb2Ntb3JyaXMuZGUsaHR0cHM6Ly9leGFjdGFnLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=552&vt=11&dtpt=344&dett=3&cstd=203&cisv=r20240214.51437&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:01 GMT

GET
H/1.1 200
OK request.php Show response
hal90002.redintelligence.net/ Frame DFA6 612 B
933 B 285ms
103ms Script
application/x-javascript 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=130c4a70ec&subid=&uid=384ace1b6d49077e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTWy3_43PZfCOOarW7OsP2_aqmAmm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObhICABKoElQJP0Dr9Yf5RcssEKITQhkeaolaNKUZcrlnBSa0PJ7eLyliZ8SJZz5IMftCl33SKCf0np6aZTZGj0ogQFDKRi_uFY057gOU2JojKM6Q7YnH-QZ1vSOuyiLfbNzOmxSfKazTKAiABRYRyxW4KNT8kqGzaauUvq_j61GyDjT6Q-Aj7Qn5M-_XPg37_pq8F9ZSKTffJocbRLGKie4XTS2DJs3ZRxFagpwFYCuwhYzh3TuZu5EHJKLxQ_Qbai-imOEj9x1UyroTgyIGQnjAJm9vIAm4Irc7O9tzet3_Ver92BLDfYwJfbj_wZmsT2ZZBajkvrZrNd4kyG483u81y_hC5OQCfgAiOL2HS_dgKudjUC4hzkIeSR1S_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljw8fHDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ%26sig%3DAOD64_2UmzPzXVIJLFsSiIscX39mK4qcxQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPMlLD4ziTWuJ5z7gxrWzqXl2CJ7Zyd8K72cP3mOOfOMB4Fg2ErT4ZumUwJ1f1D15MEHFhVe0zN6Z4p3mPXhonU3cCXYfn7FXFlEMeZLSME3N5gUSc5S7lXvoWeQ1JZRGU1aij3RMOytaQH308rjTXLRkzBA4_GWvuxe1OxTAZAdJlMww%26cry%3D1%26dbm_d%3DAKAmf-ALbY0BCdcyRXGctW4jzKEzW8XpIH2x2VNIxgiulzodxnFurvAcVTCfjmr-m1QN3--pEL64P2ijidiaZKFqoObUhHrCGO4cOpspjBL-7OYMfglOxdwgTQ-Xxo1MpwRrUZQgAl5D8myVsgzOobV8XhNl9JcyXiDA4u1V1QfMwe1ClmbmulwdSO1U07T_6MYJzOCmLczRg-BJmyDZJR4SHao8iMk6fqFmVrmc_WkPuDzpsSSgPJzQqKu1xXW9MwJER9mBWBNsPtqYLWULuSWDGJ5aO76893rE_8wxRrmRq5LLlPVxzrCCAmUbXb9AK2UfaTV5aazaCsodF4nycyXq7vjfVNrV0ST_SpRxE2BWjISHInAtM9gGtQBZAUGyDgrueZoRnA16YkyvQfOZRLmAoI0xp35xI2x3hU76_v9idqnKauWmNOJFNJXGQcC2fUhczHAYWLJEEtf7vs1gdIsts3cUQrAElfJCoWVQvjieIKF1jcuDGtY3N3KM5mz-Uodgw6Z8DZNUOjBcJbikFVWe14dgPYCXy7qdiiOaV_rHtx2KQkKCcfs%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=4242675281307&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1708101119935792&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTWy3_43PZfCOOarW7OsP2_aqmAmm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObhICABKoElQJP0Dr9Yf5RcssEKITQhkeaolaNKUZcrlnBSa0PJ7eLyliZ8SJZz5IMftCl33SKCf0np6aZTZGj0ogQFDKRi_uFY057gOU2JojKM6Q7YnH-QZ1vSOuyiLfbNzOmxSfKazTKAiABRYRyxW4KNT8kqGzaauUvq_j61GyDjT6Q-Aj7Qn5M-_XPg37_pq8F9ZSKTffJocbRLGKie4XTS2DJs3ZRxFagpwFYCuwhYzh3TuZu5EHJKLxQ_Qbai-imOEj9x1UyroTgyIGQnjAJm9vIAm4Irc7O9tzet3_Ver92BLDfYwJfbj_wZmsT2ZZBajkvrZrNd4kyG483u81y_hC5OQCfgAiOL2HS_dgKudjUC4hzkIeSR1S_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljw8fHDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ%26sig%3DAOD64_2UmzPzXVIJLFsSiIscX39mK4qcxQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPMlLD4ziTWuJ5z7gxrWzqXl2CJ7Zyd8K72cP3mOOfOMB4Fg2ErT4ZumUwJ1f1D15MEHFhVe0zN6Z4p3mPXhonU3cCXYfn7FXFlEMeZLSME3N5gUSc5S7lXvoWeQ1JZRGU1aij3RMOytaQH308rjTXLRkzBA4_GWvuxe1OxTAZAdJlMww%26cry%3D1%26dbm_d%3DAKAmf-ALbY0BCdcyRXGctW4jzKEzW8XpIH2x2VNIxgiulzodxnFurvAcVTCfjmr-m1QN3--pEL64P2ijidiaZKFqoObUhHrCGO4cOpspjBL-7OYMfglOxdwgTQ-Xxo1MpwRrUZQgAl5D8myVsgzOobV8XhNl9JcyXiDA4u1V1QfMwe1ClmbmulwdSO1U07T_6MYJzOCmLczRg-BJmyDZJR4SHao8iMk6fqFmVrmc_WkPuDzpsSSgPJzQqKu1xXW9MwJER9mBWBNsPtqYLWULuSWDGJ5aO76893rE_8wxRrmRq5LLlPVxzrCCAmUbXb9AK2UfaTV5aazaCsodF4nycyXq7vjfVNrV0ST_SpRxE2BWjISHInAtM9gGtQBZAUGyDgrueZoRnA16YkyvQfOZRLmAoI0xp35xI2x3hU76_v9idqnKauWmNOJFNJXGQcC2fUhczHAYWLJEEtf7vs1gdIsts3cUQrAElfJCoWVQvjieIKF1jcuDGtY3N3KM5mz-Uodgw6Z8DZNUOjBcJbikFVWe14dgPYCXy7qdiiOaV_rHtx2KQkKCcfs%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Blankenfelde, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 4ce7a1bd60c66084881f9db2dd98f01ba21824bf73fbf8ffb4057e8ddbe8df8e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 16 Feb 2024 16:32:01 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 56147900120536004444554012602002
Connection: close
Content-Length: 327
Expires: Fri, 16 Feb 2024 16:32:01 +0100

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame E016 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5909 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame BFB1 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame A198 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 200 00743445_2.png
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 3 KB
3 KB 10ms
9ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/00743445_2.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5270670203400b3462d3a17f40341282580a81a1682759bd1c1590c50887e2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 08:51:08 GMT
date: Tue, 13 Feb 2024 08:51:08 GMT
x-content-type-options: nosniff
age: 286853
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3014
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 00571748_frontal_3.png
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 5 KB
5 KB 14ms
13ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/00571748_frontal_3.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

146c1d0d74010aefc1f83d0cf9863c6247a553a5a3954efed7bca6d0fb749ca1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Thu, 13 Feb 2025 07:41:44 GMT
date: Wed, 14 Feb 2024 07:41:44 GMT
x-content-type-options: nosniff
age: 204617
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4929
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 15399835_2.png
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 5 KB
5 KB 12ms
11ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/15399835_2.png

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2fd3d41cd100e621489711fde8601d4c51e6745c8aaff7c460cff09a0fc855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Sat, 15 Feb 2025 05:00:12 GMT
date: Fri, 16 Feb 2024 05:00:12 GMT
x-content-type-options: nosniff
age: 41509
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4713
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 8 KB
3 KB 13ms
12ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/logo.svg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d3c20e0c23af2e126af2e85cba7fd6f7ff72b738eb9eede07f74d0f824fa533

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Fri, 14 Feb 2025 20:50:50 GMT
date: Thu, 15 Feb 2024 20:50:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70871
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3325
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Mood.jpg
s0.2mdn.net/sadbundle/12261433104488845109/ Frame DA58 84 KB
84 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12261433104488845109/Mood.jpg

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d04cfd3213d087bec434cfdf134079f7382128936c53c05bb45ccf8a5b8fc54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12261433104488845109/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

expires: Wed, 12 Feb 2025 21:24:33 GMT
date: Tue, 13 Feb 2024 21:24:33 GMT
x-content-type-options: nosniff
age: 241648
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86067
x-xss-protection: 0
last-modified: Fri, 09 Feb 2024 12:24:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H/1.1 200
OK request_content.php Show response
hal900023.redintelligence.net/ Frame 036B 7 KB
3 KB 33ms
12ms Document
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request_content.php?s=94720300137361804444554012602023&a=8baa24ff
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ae1bda8cb6&subid=&uid=392081d8fb999cff&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXvui_43PZeXFNuLs7OsPyMmUkA-m5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0Owk9oLq8YXQmdv_meE7aH8DFq0dg-mx5Mt0gwI4ew-cjT733sP9yxftZINe3XS4wgqWosYCQ-aAWL28BBeLyR2b05uz31uRPuswEK5cYxIwVT8v1Rl9owzACJGSVZlSFW5cFe4BkFL4MN3MnFSkSqFJBCWGkEjcXwYc6R7HtZRoSmRWbBWFqp8QsdC7tBhEY5ga0N4TBRFXtNfMouMe9I_NAZHKvp57NVLGwuDdLDURfD--S1NNumm_D0XESMrNMgqnk595-fQ4B5NQVEim4h_MRAoCOI2mVsPZFA5bKt0vhHEgOpn85pkovs1BZdnuVHfAXWQH43jvxsFyyjTor1xwAkS8bC7mn9XzdqpmwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljXqO_DpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgAvHhf_bSWZI6_hvMRlRalCVLbnMftwhX1lU1XYsCQLbmJrGLej1oSRu6Ppt_MehNWjA5SF7cCl9nul3Rd3fWzpFQ9PSdLGLtxJReQBbxgB%26sig%3DAOD64_0VoNECw7f9nS9M5vGzWf0YFtFWww%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-C-wWTMDDWQGakLHEMzpN0tzzDuNxn1N1khVIltq8eaq1cDBvOcZMngXyb631m8eyDfJ15Gr3nFlvbnJpBon82Pn7Z2B-PcagIlsBuwJJrIW7paPiDzSjtXovFkkHLFi4ErTxlbHrWGpt4trqRNRTCW9btO3piQ022uJMB3wy2bAjV1Aes%26cry%3D1%26dbm_d%3DAKAmf-AO-b2F88hN9BU3WprayDHvbp33UeGfwKc1fmj9SyLDeHB1Eg79WP3OoVCF8PN5QYJDKKNw5j_8Cyc4ZvJkv-TGdvOrjYs2SMkJCTXX30WiT49BdSk1k1ZT0Dj8anP1drDwUz15JGCh8L1lM1APUCw4Whs6Tg5ErqwAEvYN7rrNOLpaET-LUJl2D6ixe56SzxV5KONXOrK7l9knGe1t6bb4dSpsIxFsQeE3YTKlQerIAEJlpL01kwUsRrO5I8SZjt3ew-Q8NKvWYpRzNpIQ6_zUgCtN8KN3JhxiQgTTSpiThuL44HhGqOInmN-2nBZCAxfwN6INPextX5ribUj6b9faKkOs10JoVkIbuAvFSeuMIKuJrSFS2Y-fya63ecX3hw9uzLg3eX9ZqYjynM1XIMPcIR0eTwCmHZklYMz8vgxNs_14bjH5Dhvv7SeSJ50XKd4fiZi3Owz-UDvJs2LbhFblZW6L4GarQD2zr5m6TKJsBkTz70fQPSFnleu-r9wtx69zyXsr4qCggS9X89zYHof7N6sZOle1_5RCng6bolR6RB74kDA%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=6970069046205&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 5f97a20d1a492c35a0391ea1b5dcdf0210714bd41818d9d88ceb1de3b648bcd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2305
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 16:32:01 GMT
Expires: Fri, 16 Feb 2024 16:32:01 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK request_content.php Show response
hal900010.redintelligence.net/ Frame C43C 7 KB
3 KB 36ms
15ms Document
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request_content.php?s=13762700138580904444554012602010&a=abb27e08
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7b90dda751&subid=&uid=b269bc3574f088d9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCyvJe_43PZbTEON2Ps8IPgu-X0Aqm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoEjwJP0LKti4zOx8rRdh4VawgPocMunoZXzJ2_HWuh_ouJRtCUdswQTHTgAZH2b74JWGtsV2Hyo24NTVaPX9ZkbJIRnbsvQ8joAvERNtX6L7kzzW6VS_7mjebbWZw7YGUXf68W7Yt13IDFDoxB01CE8tJCceOMZ5EG4Dv5S8MO4IODAmIxBFhtVgr0pOVkX908OeF3ELJrw75fJnDlygmSHPMvmoYu6kyhxP9jy7CUZkxOJzOTRM8-AF7K1grj3JsdHQl8FuYQnhzK2Ypf6vCcbp6Kq5vQ6kef9AJ5QuwFHtFqiK6YDQMHyJ0ZI5hUl0mCwBEB97Kx-cc_qwm9eKYwpTktkIs_Zpv6iw0K2TdvH7zLwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljNo_HDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_7ASxXvm8I0SuANRDbQhgEGSeQANLtxrUYvWzMWYl79JTzI76hS4vK4mQKkOEqcdbDCwRr-P8VzxRWwsSNtORgNwZU1WhvqD4b84YAQ%26sig%3DAOD64_1-Hk9V1IUruPcYt9nZJXt8kExzrA%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-Co7_H40pnwE8avewPHokHcFUyi-zjtfJmtz7rIQg5dMgMlDGBCEgKu3s3GNgJJeoKGjakj8yz2jdms9SCUl0q5FWvRm7HWSPqmCBoHMHkG2DUdh1RCOH7MZMT6h_IXz29In1gxH_1ix7yPNQzOTXgfjvAGCWC-yZb0ZRVv0KiblWzi-iY%26cry%3D1%26dbm_d%3DAKAmf-B2ymos0AmDGEcPYSBemv_qhrDQv2jdJu6iH5vCdcOmmgMOjrZnKS7GeFVgitXFtjUKpHHWWlKVOGWOQt31utRJ9fyqldHxrRW07-YkJRLglcQEG3MSwhXgQs2bs3PowZOiQ3AuJdrJMy1SzFGfGMIyzi-9q1t_TW_CQOuxVODeL_tHu4hSy7GOAXzllnBxknZAlEjsESNsoocgQ7c5aoKxzJ1-uV3k3-vfcSJU-4ZEbX_JqoTWdmV_evxKgzscTSVoy6f6bAlzQKWFnToNuSvKsHUcJSirHUsOMpotb0zjFa6OAAt5sP3IWus9FSY3rNDPQExKXakR43dgFwZXLF2l9nM_4WQAaXJ4BBpOJHnlhYpOKiZxU-9GUeHYdafQyNeT5k1ITm-eUnZScmu5ZbU1IlgCj2BcG0fQJrqNLJkOPnBAnCbDi80sjG82JVx-_fLQ-uiWtzvu3K_ArbKCaLLK1swEtwSh511A3n5QaZzE4lUsEfpD-D_Iz5C0M-nCS65bh8mDV_7IGmps8SW18sNO5pibn7UwOTIAPZuCQrQgvV_7gtM%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=3653088913749&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4afc7a2ee37733e8192e1127119da0bcf109a912cefc70353a405c5cbcc50d04

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2304
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 16:32:01 GMT
Expires: Fri, 16 Feb 2024 16:32:01 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3177 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900016.redintelligence.net/ Frame 3ED2 4 KB
2 KB 33ms
13ms Document
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request_content.php?s=68380300153219504444544012602016&a=ce8ff13a
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=d44a242ffa&subid=&uid=9b33dda5b97fd2a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCocIf_43PZd7WOfeLs8IPzrq4uA7r0sGhaZ3x3vTFD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObBKoElQJP0Her24VIBIaUEDWXsvKsO-j5YZll5kXev_UJSxFup00DmiObNLBjxDUiNA1bOD9yiJAtfqrbXioVdOFYFv2Iav7fWCTKFSrbWFbB84mutExYx0rxV8pN2t12MyhC40BBFKovXLN_fLfpcS3PvegxjtzA1yBfzpRbe9wngwLlStDNOK-_AAX4nnBw2eWw9fmRJeELWy75rxyaj7wWg-J66Y3BSTXlHoO0E93Vodlz4ydgHKdT8s_o3X9yDBPKd6JuS87aUPJ_alYPfpkqEDG-lDWexFr6eNlqr0KnVWhKqi6Sske030Bw9uucR188CCSScWn4lngJvmuUlSp0VtejqmwAr3w_JsCl01EZRbD0BmaN6Bj8wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOliUqPLDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_JojHXfM4DEobthCT-WfEQudMU17B5Zt9olPH5bI4T9EESkLBkI2ovL0LiWwTBIBLlbeH6nP0phINs0It7X5FfaKxAT7S7AZK0NgYAQ%26sig%3DAOD64_08bAxOP5KNznc1wKtjtfAOmMiQ8A%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-DNOghcbn8S8wfoQBdLS0kYjBKXUJ00Z4bN7iRkn5A-Zt1cgmAOyJHPWtTTH461_sLf0H9rH56VvssPXmyY44rlG3SM35HFm7wdWM2iDuaR2l4hlhQCSZ4scw92m7YMr5IoW7TAsekcain72m9jQJm2r8T9FsC-X51FnJ9PySA5lF2hnlY%26cry%3D1%26dbm_d%3DAKAmf-A3zSLfbP5DM360iAJqy1nHEWmDLa7ZmIacJx2OF_8R_wvM8G_8rKuCEISDkBJDI_eILe70VlRM-U7CBpPEY8Au1km467Y3YtGGdaP5u83VkbDdvZ7O_ELv2nnNfrMxQJw2_RuMyD7jrJMDJRcjKpC7llymf6ZVjspLrSp8ubJlLiVDYfg0puBBex4kgFG_QRsaiy1vo5uU_SImiaQXAdfQAE8BqXy3kdWFB3XH-ukD9ArMRMcphaDZFbK9BDvH9noJjSmMWy2jACBsDvGMbQ6L7YiGYtJwIRPe831vbAGW25avGmlotzA9UoT-RHH33HQW9P-WsLJ9mAAs-hk4h512J5o-Atx40xTTURps1QlqA9IrWPISWW9udcp-R2bdmm54um-p1BCEIs_3ftvVSAJQ9VYo7nV9mWYG2cGYQIJgxSnosBiRdnnvTuDIasMUD608-Gy0ofBs3Y8kVO0yDlKY20bwMI8ZL2zZHgKyZr4WzBeA4x3ED_YxYKAZkousBTct21bV6jZEO2AKlODm8rSCIGV_a474J_AVLm8QedYmINafRO0%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=3286137046736&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c71634f0e298f317265e0a654c24827cc73de9201c689a60e0c48222b0d0f6ea

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1502
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 16:32:01 GMT
Expires: Fri, 16 Feb 2024 16:32:01 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 091F 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
DATA 200
OK truncated
/ Frame 1418 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 00284e5acc20135f27f9235e4a548711bae5e622d963110b3c7197e59ebe406c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 7AC2 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 200 VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js Show response
pagead2.googlesyndication.com/bg/ Frame AFEB 51 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VWSJSM-ccN57m6m2QPs-NP7cxacmqKiEaeV8lk1iunM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55648948cf9c70de7b9ba9b640fb3e34fedcc5a726a8a88469e57c964d62ba73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 20:39:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 244347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19939
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 12 Feb 2025 20:39:34 GMT

GET
DATA 200
OK truncated
/ Frame 2961 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df6f6729375c98b7a3ea68cc09cee064bca998f2c87549888927335282281325

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 44B9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f876bf2de2656320c17e6493d8f519ec40df34348b788a7a8fe05a5639106a48

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7B44 0
0 46ms
45ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv1RGA1BE1tJs62cfNeuTdhEefdIGiyHdYRjnf0yqkFutM1kVLrVrMsvAjuyRT85QsGDerbKlps6rlpfXg-aGxrAObY6cBrka8uNlUEmfcJVmp7ZDySWl2y0q3XDBidq1QV02B_bu1xw5n8dm1nNFguFPVH3D2rLNpQm4WueMVTzFkUqZ6PeRcsGoq8s5sNmWc7MRzAIBCg9u8X9BRxrxbKADgyeAvZOwzdMWVHwDnOA550d0cq_KZTDBT8bnQJR8F76aOqmwD4neejPbzO77N3sOeqawA5N26f8FjflrnVO4f-h6N37sOAJ0MFCEAIOu3DISgPOl8yXbNzDWg7KjDy1h0wBX7XnjQbHOSaIQjMtHYYTTsntzeutblfA2AzHt__XEDcziF51IkWQzFPU347qRn2i6f34YZG8G-9KB8FHwqauGv90b7bwiJty2ftfD9ZptiyLGpEkur6xdlxnyoTVHuMK9nmlpYS7f0guzoIMOm-5yVAFrWIa-CgrNWIDwivMCYKQPDbbPA5s1xsLYqXIW80H6IJBN6U6LfDiQBqU_fSUnriu292_Kx3eJXQvpeWjF-KWJDROz4WqZiKIu1rQJZPbjEDm7oI446v5coYkBqPTQuTFOuZohuXt5WfBBXAT54TD-L_-4VTBp8hEbrNCFshsvpKPXX-CWPo88nM06vrW7AbZh1agF3LHzb7tL9z7oiZRQx6jH4Gx7seQF-0cfwuuW1lNrNRnUUuTtN3JZSQKxTTg2RGQL0ZO6-FVQkeQPa9429rnaNwbxw-Kvwchwgk-oj2894kiTE7iLYSy-1N7wFy3rLvwlDek6zGhp7zwZp-DS7fbKrCWbsHloJGcK9xWLDAAPDjv06Ts0ROCMRr8fHPVQUfpOJ39Z2K-osEtMLWNz1M5L9mP_Yu5KDRJAJ2-78V5MgXBhh2foU1dPGYerdZsr70tojzLSlNBbfeCh8UjcH6YpMsKgdFZCfN2zNACF08j5BpoEzKugm3Cb7MH_6h_koCr-pKzP0V5XxHlsv2IEtw4Ns_Sp5NvWojXmNZjFn5RjgQdxRlNibWLi09mFg6dK_6kahSC6EBs7zjC40z51BDLq106GmY61g7xDwzBTVGGB1GrrEPnnP5YutUNKIs_kdy64P5JzFNmKUnNl3mhkAjuETXueCU-rCmajBa58Ntv0DeSJQleWQ6MPQngEbuUtfyPKNKwmHrJLDZlNbqJ6jO7Jgs1T8HM8H9SM_LRKgD8a2zBCvWLqo8PbxUf6-SB_nQ6LYGL5dM0H-2SaThVoIUM1rinNTYb6jOnMK80aMBnMCqfFzbx4kE_UVXAgqIxjKjqoH0q5jEWch7V-zOQvFGx2tTcAI0V-KzcSORnHZJNkVLp-J6TCMicAd_amSbYFGq3OFJGVhG4h76JFWHKiUltqDz7kT0HWhKtwe-IQ&sai=AMfl-YRfP7hPPclTzBqDtJqIzfsczSKaP7ZDFQ7GkPUVDHg7UOo7S6qUKvc8nlh6xld0GM2sqv4vEpEPSwVQMGU1f7e9WlZwpnOmLUW5XezAm9w38Dz9-4z6009Na1Ip8nH7nSm_ul8Ui5_LP6xUTlfm_yzBXJVn6gM3PlcUQowsTt6gEsQCDbGNJKZVLX9t_BQUeX2k3wuoy8Py4h-rlzFcORZjgfuBbrMFJk-XuZK11IDz5eeiRqUBGhqv7cDAeO2wKNoSxKkIiYEmB_stLT2lBEaj9TymNq38P2MmckKk_nM4uEPY6umUJtmD9QcWPrdcJss&sig=Cg0ArKJSzHZffD5W7FLEEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=482&vt=11&dtpt=292&dett=3&cstd=189&cisv=r20240214.43935&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:01 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D536 0
0 45ms
44ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvioUDzseN5-JHPxlJY-80L-lNsLl2hOjEbYg1VfQRDnENj_LCpvcBjEAK1NqYdZA-YUDCgio9YCX7rZNnEUKHg4YRY2_UIWoZ5SNjTtY_yjpdYfTAnpyVOdM2I9eb0bIAoBQ9_mS18VpzWgt4qjVeeg9USlnr2Zciji8bxY65vLBNI_-ISUhyz8edxRR5WFY1D4bGf1Q089qLX49N8isluT1L6n5QZtECKwOx3NcLEBBpu0ZMlPxKt5DZsk2XxDZtHl5WvgU8D5QQdwqf4jrJTqaHjUYS5qSs5acObj8VAQCL5uRp-4H4J_EskF1pk7ZtJA8lBJUHHtENl43KihY6ykzkR4sdDapzyU-yuBR9Is_jxK0LQhSncj95xUH1Z37S1Yr9YjAdoBGmXgFIVlqPaVOtK22XmDKxEPQA7OD87jf1DfnmNVuwLS3eBn8gbDzJCW5id7SBua1e-jbrkqZFFNUwjMGNbRtrQ4PAcRDzTcl4xtD3c2xFq5qHgD8AmKD2fg-FTjQWDag1tYdJKYS9Xc0NRWDfOHsGzcVpEop9sOWKQVmcPS92loY2aZ4zTjrgILVNuGsw6SDevxc1o6R-SdWduzT6224Jq76NgFS9bmaFdQHD90dM-GGYr1gcldOz7NS50KDm4dJw4nrj12zL60n_Bg7FuCStGnPsoFLY6qRO6vhT-oOvlT6gxKG1zFmVzTtJl0S8VQ5W1TN-7YZftvTTTEuUC_JR0HaRzxk-FoW-Cj-MO0vz4yLN0LKxuMrvDvmXklwPJbfCxNMeBTql2XgmkcaqfBwQY9f1qinsxZZv-QnaAlp30NIKKq71OYB6fqUkhji3lPm9Hvscis-BOckigGQtZX7EEpPZiqLnrjPQdwcb2_jlKUu1zGiqFiVsga4RgIbNn7XDQ1G7Q4KXBVqSoTEmTBn3NkFFzpn5zT9l6CD_E23okmlegd_iBOEqUlg_NxFYAWwa9s_wNuPKwnzYRpoW95pyAef6D3TT2sE8-bvdM21DeBUQmHGorP7ZCFsk8v0sRAWYUem4z7wBhrB0Sr_Ha6r0EVsMouM4_8TgULGhwQJHUpWoX9xmxNNlq7qWpxPiIXlIzvAL5bngz56XVYQFNZYwyMXw6ducqTwMJ1wVbb5mzIUzcIddXIqukDjLnFdMsq3uJLbfthZplEZi0deqamLZJoTJMgx5oktRDr8eAlhxZC61Yd7Yfn1hcuXKhsXWgPYPguS7SZqhKSGbuShPC9iC7x096kQhHLrrsTtP21WRV-KNNlDLCU0kPn6ZvDxb_GulpUzT7SJgdGdW4BbmFc5jzksJFCChm_2dfzof5HszxMkpBiUUk8q5f46pRxGYkoUb1RYEU3NKeg4470HZhwOFJWAfI2eOJEq8PKchH0kZrJ7O8sj0MNhoIMKjnGw6diyPGHiHQHBdm93JuRg&sai=AMfl-YQOvmDdZqsMNOx9snzbGZPGPYuB8KD2lZObAxQlPFr_m-DjaE21G3BO7uN_XOZSnyP_itN3MBqhMeegCCtDejgRHgu1y0Qdrpev_H-czbl5LmnlZYCmeFD59aa3OfOYN_BKEFdXc6IndPKwl2KGzv27gVnnaplzEiZ1dNIY2nRL9EWoCMKWi7IblwIQd1E-qNoe7OxNHV2L0uoZnHf0ODRjfhAZWZqSPGDdPQYfHoMkSitoh17vPCdnbbaMYZgRcpZUxrjf9Xa6sKlfRmda0UsjtDhNHWw6ntCgRXGAR4RXdW-KNgskPGkVhD7y2QjGwHE&sig=Cg0ArKJSzN68tAoFCGDZEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=414&vt=11&dtpt=287&dett=3&cstd=126&cisv=r20240214.42795&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 16:32:01 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame 036B 89 KB
32 KB 28ms
8ms Script
text/javascript 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=94720300137361804444554012602023&a=8baa24ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:15:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 234986
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 23:15:35 GMT

GET
H/1.1 200
OK S-300x250.gif
cdn.contentspread.net/24i/content/soberfb/DE/ Frame 036B 70 KB
71 KB 50ms
13ms Image
image/gif 145.239.2.103
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/content/soberfb/DE/S-300x250.gif
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=94720300137361804444554012602023&a=8baa24ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.239.2.103 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS: ns3082036.ip-145-239-2.eu
Software: nginx /
Resource Hash: 8aa79a5d6fdffd63c26f013cd8f1bcb12ed624ef714702b5850cc30b673e6a37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Last-Modified: Mon, 23 Jul 2018 15:19:52 GMT
Server: nginx
ETag: "5b55f218-119bc"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 72124

GET
H/1.1 200
OK S-300x250.gif
cdn.contentspread.net/24i/content/soberfb/DE/ Frame 3ED2 70 KB
71 KB 48ms
15ms Image
image/gif 145.239.2.103
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/content/soberfb/DE/S-300x250.gif
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=68380300153219504444544012602016&a=ce8ff13a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.239.2.103 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS: ns3082036.ip-145-239-2.eu
Software: nginx /
Resource Hash: 8aa79a5d6fdffd63c26f013cd8f1bcb12ed624ef714702b5850cc30b673e6a37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Last-Modified: Mon, 23 Jul 2018 15:19:52 GMT
Server: nginx
ETag: "5b55f218-119bc"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 72124

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame C43C 89 KB
32 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=13762700138580904444554012602010&a=abb27e08

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Tue, 13 Feb 2024 23:15:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 234986
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Feb 2025 23:15:35 GMT

GET
H/1.1 200
OK S-300x250.gif
cdn.contentspread.net/24i/content/soberfb/DE/ Frame C43C 70 KB
71 KB 45ms
16ms Image
image/gif 145.239.2.103
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/content/soberfb/DE/S-300x250.gif
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=13762700138580904444554012602010&a=abb27e08
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.239.2.103 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS: ns3082036.ip-145-239-2.eu
Software: nginx /
Resource Hash: 8aa79a5d6fdffd63c26f013cd8f1bcb12ed624ef714702b5850cc30b673e6a37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Last-Modified: Mon, 23 Jul 2018 15:19:52 GMT
Server: nginx
ETag: "5b55f218-119bc"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 72124

GET
H/1.1 200
OK viewability Show response
hal900016.redintelligence.net/ Frame 3ED2 0
150 B 33ms
11ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/viewability?s=68380300153219504444544012602016&a=c574f42f&vb=m
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=68380300153219504444544012602016&a=ce8ff13a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 Wuppertal, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/request_content.php?s=68380300153219504444544012602016&a=ce8ff13a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 3ED2 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame DC8C 4 KB
2 KB 33ms
12ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=56147900120536004444554012602002&a=830e4414
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=130c4a70ec&subid=&uid=384ace1b6d49077e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCTWy3_43PZfCOOarW7OsP2_aqmAmm5b2gaa2VnKfJD_AuEAEgzZTkbGCV4pCCoAfIAQmpAhOQBwxQArI-qAMByAObhICABKoElQJP0Dr9Yf5RcssEKITQhkeaolaNKUZcrlnBSa0PJ7eLyliZ8SJZz5IMftCl33SKCf0np6aZTZGj0ogQFDKRi_uFY057gOU2JojKM6Q7YnH-QZ1vSOuyiLfbNzOmxSfKazTKAiABRYRyxW4KNT8kqGzaauUvq_j61GyDjT6Q-Aj7Qn5M-_XPg37_pq8F9ZSKTffJocbRLGKie4XTS2DJs3ZRxFagpwFYCuwhYzh3TuZu5EHJKLxQ_Qbai-imOEj9x1UyroTgyIGQnjAJm9vIAm4Irc7O9tzet3_Ver92BLDfYwJfbj_wZmsT2ZZBajkvrZrNd4kyG483u81y_hC5OQCfgAiOL2HS_dgKudjUC4hzkIeSR1S_wATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQLYBwDSCCYIgOGAEBABGB8yAqoCOgmAQICAhICAhAhIvf3BOljw8fHDpLCEA4AKAZgLAcgLAYAMAaoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_f-IYJxRBaC27W-5DkcZg-sDhiH_weptpy3NAfSF2PcuPHVDVuYwHqZJwFhC8UW8Z8sjxRThcSj2S2egajW7J0Tgt_uDz1XED7TAYAQ%26sig%3DAOD64_2UmzPzXVIJLFsSiIscX39mK4qcxQ%26client%3Dca-pub-9323971679203656%26dbm_c%3DAKAmf-CPMlLD4ziTWuJ5z7gxrWzqXl2CJ7Zyd8K72cP3mOOfOMB4Fg2ErT4ZumUwJ1f1D15MEHFhVe0zN6Z4p3mPXhonU3cCXYfn7FXFlEMeZLSME3N5gUSc5S7lXvoWeQ1JZRGU1aij3RMOytaQH308rjTXLRkzBA4_GWvuxe1OxTAZAdJlMww%26cry%3D1%26dbm_d%3DAKAmf-ALbY0BCdcyRXGctW4jzKEzW8XpIH2x2VNIxgiulzodxnFurvAcVTCfjmr-m1QN3--pEL64P2ijidiaZKFqoObUhHrCGO4cOpspjBL-7OYMfglOxdwgTQ-Xxo1MpwRrUZQgAl5D8myVsgzOobV8XhNl9JcyXiDA4u1V1QfMwe1ClmbmulwdSO1U07T_6MYJzOCmLczRg-BJmyDZJR4SHao8iMk6fqFmVrmc_WkPuDzpsSSgPJzQqKu1xXW9MwJER9mBWBNsPtqYLWULuSWDGJ5aO76893rE_8wxRrmRq5LLlPVxzrCCAmUbXb9AK2UfaTV5aazaCsodF4nycyXq7vjfVNrV0ST_SpRxE2BWjISHInAtM9gGtQBZAUGyDgrueZoRnA16YkyvQfOZRLmAoI0xp35xI2x3hU76_v9idqnKauWmNOJFNJXGQcC2fUhczHAYWLJEEtf7vs1gdIsts3cUQrAElfJCoWVQvjieIKF1jcuDGtY3N3KM5mz-Uodgw6Z8DZNUOjBcJbikFVWe14dgPYCXy7qdiiOaV_rHtx2KQkKCcfs%26adurl%3D&documentReferer=https%3A%2F%2Fcsgowfire.ru%2F&ancestorOrigins=https%3A%2F%2Fcsgowfire.ru&random=4242675281307&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Blankenfelde, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 35f0d75e0e939ee28d10d6b4e8580020e6fb86ecbb9450a6596b3135aeb66f95

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1500
Content-Type: text/html; charset=utf-8
Date: Fri, 16 Feb 2024 16:32:01 GMT
Expires: Fri, 16 Feb 2024 16:32:01 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame 57D8 216 KB
67 KB 125ms
56ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 330769
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: iUY6CGLz7GKlwPFcj3NSA3O-zdkvcMeqhtTLLH0NOsf8uMoQ8bRKFA==

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame 9C3E 216 KB
67 KB 95ms
27ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 330769
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 2iYe3B-LXU8_DUv5Iwjk9XqNUte6lOo51e5qNhu02YSqH2KEW04X2g==

GET
H2 200 main.19.8.483.js Show response
static.adsafeprotected.com/ Frame 443C 216 KB
67 KB 138ms
71ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.483.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da48bc52d5e10176bcc636931d9560d04f283b20771411ce0ca0b26320b29a84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 20:39:13 GMT
x-amz-version-id: ixRMmv01I.PQMZuMFiLKLt94Cut2dK48
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 330769
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 12 Feb 2024 18:45:23 GMT
server: AmazonS3
etag: W/"b5ee14757eb2b926012930e9b7f14184"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: RF51p1dTgtXtKq8_W7ja7qQ_PsN6jADvC4AKbXBuUfoSz1fyFgpyCg==

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame D536
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1712834/75654858/4.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013453133&ias_pubId=pub-9323971679203656&ias_chanId=1&ias_placementId=20921000617&bidurl=ht...
https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZbO9Kf-t9u8PsKaywAw&cbFunctionName=goog_wrapCb_AI7PZbO9Kf-t9u8PsKaywAw&true_pb=https%3A%2F%2Fstatic.adsafeprotected...

1 KB
1 KB

22ms
21ms

Script
application/javascript

2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZbO9Kf-t9u8PsKaywAw&cbFunctionName=goog_wrapCb_AI7PZbO9Kf-t9u8PsKaywAw&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5431bf3cd2099a41e143f4ccab7ee74d223ea22941dfd9061c5d241ed05afade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 18:45:03 GMT
x-amz-version-id: N8a6HZlDh9F3zdobaU4MToCpsTqdbQs8
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 337619
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 12 Feb 2024 18:45:00 GMT
server: AmazonS3
etag: W/"eb639ea9c60fa52fae8bd853911ab0a9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: dOa5WIW-6DDO7XzV2F2pAEbV5jYB1ah3k6uj_j7XntWBj56bA2WU0g==

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
server: nginx
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZbO9Kf-t9u8PsKaywAw&cbFunctionName=goog_wrapCb_AI7PZbO9Kf-t9u8PsKaywAw&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 4286 91 KB
23 KB 106ms
82ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 10:50:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 4426905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: T9czAd_80SSVAFWpZi-5A3BGDSmJzOgqIvdbYD3r9KN9DfBvUcwnmg==

GET
DATA 200
OK truncated
/ Frame DFA6 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e7f04d944b46c3c9b4f1a6fa322acb6ec0e6e906635c6d234e825aa66884d3a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 7B44
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1712834/75654858/4.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013453133&ias_pubId=pub-9323971679203656&ias_chanId=1&ias_placementId=20921000617&bidurl=ht...
https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZdmGJd689u8Ps_C3-A4&cbFunctionName=goog_wrapCb_AI7PZdmGJd689u8Ps_C3-A4&true_pb=https%3A%2F%2Fstatic.adsafeprotected...

1 KB
1 KB

20ms
20ms

Script
application/javascript

2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZdmGJd689u8Ps_C3-A4&cbFunctionName=goog_wrapCb_AI7PZdmGJd689u8Ps_C3-A4&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5431bf3cd2099a41e143f4ccab7ee74d223ea22941dfd9061c5d241ed05afade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Mon, 12 Feb 2024 18:45:03 GMT
x-amz-version-id: N8a6HZlDh9F3zdobaU4MToCpsTqdbQs8
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 337619
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 12 Feb 2024 18:45:00 GMT
server: AmazonS3
etag: W/"eb639ea9c60fa52fae8bd853911ab0a9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: qidTmMH1dWK4rnk0kPAO3h_sIA4E8SZNcS0h0tCoOk1UTgAGP3VzpQ==

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
server: nginx
x-server-name: app22.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_AI7PZdmGJd689u8Ps_C3-A4&cbFunctionName=goog_wrapCb_AI7PZdmGJd689u8Ps_C3-A4&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_160x600.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 1E25 91 KB
23 KB 36ms
36ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 10:50:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 4426905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: G-oBn6c2uKDWWK9ZxR1DGByzoR-sEvfB7ak0d9Ke4-du_DR1wpKS2g==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFDE 0
22 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BC5zY_43PZYfXJJrO7OsPvdap4AUAAAAAOAHgBAI&bg=!PD-lP3DNAAZN4L4YbeA7ADQBe5WfOH9n9I4yI8lS9d_roDhU8mgsaQicsMrCWAI4yFrbeax2IxKM3yyV6PWtryHIkvL9AgAAAblSAAAAAWgBB5kDHolFtrYatdNJnV5ZUxHb4c6TR4RuBm4xfkyCQnMXnbmmWg5NivGhOHxnyAJvkteTpGGm15Q9TnuDY2wZvHey3HzdLh9KBKalAaujVKL2P3YiJATQacrgQp8qvnM5naDm7kpbpL2qcuul2akpOVHAs5naWXjn74wNU9YdLzK3brsCYOH0f3BNWaJmZATLFsn3hC2tniDKE1lzeIq2c4rIQcP5PmyvPusDVmF30gAx15vkXvixA6mpDWTprZGR0fPX9kzWC_GPYSu_7VamPDRS7P3g0P_svJdgo3OSZyJI-kZZaZnQGduF6tuY6igjo8bSbJtl_POfnIxo_KyDp1CeVC8ONw1kq4xmxe5xshRN4N1VOfTL-I8mNpbbaMZAdptsq3109LFqgZ1GuN7KFDvZf8GTb0-hkNgb4tnpgyziQudslmPNkLR8th_aJzeo9Vk-71AnHVjbd5bJz26eQUhXnXjV9o_Afq7qLJj_v7wbVqNDtuQuTlkAEbPT2s5jUDbeh__z9aF-NiXf68AiqxA_UGhhhxLRKB7ct5H2CS8YrApRw0l2yDSQltakmG2N76bqg0_CRt1vwYVytbB9IwbAG5AsTn-QhZqWF2wE7Ye4Vc0858-7pkPpXRUsEJKVVATnyaTL-7yUTlJa3tjoaI48nRmnUHhpzPR2UHLRZyLE2LFlTKpr4Ymf8oq09nABch2UkCoYPRr_MGLTW7BLF5bjYI1YwVnRx04PDkBoPStdKxYZBJrOCZopS2yZki2TizME2Uq46AR2dXheRPPx8JRPyL9I9DF4IGC5U3jd5sp8yluMhKba_4HRllDFYDxlDJms38w-ijKD0PhFHeWym8riq8oqbv_DK_2reCvDS-iBbBEhQWMx3Qu51Fky0VRZcG8w9rVRHMd1COjraBzAVD0nPjnsItHm-SFS_N_94YfIpm0GEYZ3Zr_Oe3ZgTUPK3PY-BkKfU4JgRZW0FNfFLvQ_8wsGqyZgo7gRfGSEfBogaMhFr7gCNu2Jsdl729JjoOlGZfJtYR1NMwAOTmFn9LZzdh0HC0VNkT_KWvjO_YHe3w

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D536 43 B
215 B 729ms
350ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ac1b1aec-4855-2669-8e69-e092474ae536&tv=%7Bc:4pf1Pc,pingTime:-3,time:155,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:155,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B150~0%5D,as:%5B150~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h121%7C1h13%7C1i1*.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1j11%7C1j12%7C1j13,idMap:1i1*,rmeas:1,rend:0,renddet:IMG.us,siq:21%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D536 43 B
215 B 725ms
348ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ac1b1aec-4855-2669-8e69-e092474ae536&tv=%7Bc:4pf1Pd,pingTime:-6,time:156,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:156,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B151~0%5D,as:%5B151~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h121%7C1h13%7C1i1*.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1j11%7C1j12%7C1j13,idMap:1i1*,rmeas:1,rend:0,renddet:IMG.us,siq:21%7D&tpiLookup=ao:csgowfire.ru*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK S-300x250.gif
cdn.contentspread.net/24i/content/soberfb/DE/ Frame DC8C 70 KB
71 KB 38ms
14ms Image
image/gif 145.239.2.103
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/content/soberfb/DE/S-300x250.gif
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=56147900120536004444554012602002&a=830e4414
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.239.2.103 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS: ns3082036.ip-145-239-2.eu
Software: nginx /
Resource Hash: 8aa79a5d6fdffd63c26f013cd8f1bcb12ed624ef714702b5850cc30b673e6a37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Last-Modified: Mon, 23 Jul 2018 15:19:52 GMT
Server: nginx
ETag: "5b55f218-119bc"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 72124

GET
H/1.1 200
OK viewability Show response
hal900023.redintelligence.net/ Frame 036B 0
150 B 35ms
12ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/viewability?s=94720300137361804444554012602023&a=a0758fbb&vb=m
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=94720300137361804444554012602023&a=8baa24ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/request_content.php?s=94720300137361804444554012602023&a=8baa24ff
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 036B 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7B44 43 B
215 B 707ms
349ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ae890cb7-cc4a-1137-b06d-ecfa18a45ced&tv=%7Bc:4pf1Px,pingTime:-3,time:94,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:94,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B89~0%5D,as:%5B89~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h1*.1712834-75654858%7C1h11%7C1h121%7C1h13%7C1i1.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:1h1*,rmeas:1,rend:0,renddet:IMG.us,siq:18%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt03.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7B44 43 B
215 B 704ms
349ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ae890cb7-cc4a-1137-b06d-ecfa18a45ced&tv=%7Bc:4pf1Py,pingTime:-6,time:95,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:95,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B90~0%5D,as:%5B90~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h1*.1712834-75654858%7C1h11%7C1h121%7C1h13%7C1i1.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:1h1*,rmeas:1,rend:0,renddet:IMG.us,siq:18%7D&tpiLookup=ao:csgowfire.ru*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt29.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9494 0
22 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BlhRjAI7PZaz_Gd671PIPj-mHwA4AAAAAOAHgBAI&bg=!1dal1pnNAAYBC1i-IQs7ADQBe5WfOHxGlnug42Y01XLEUVz0VIxF_pnHsAHOP0j8q_BpEjOrs1DF1IfKg2rextx8nD4BAgAAAYhSAAAAAmgBBwoASn2SmOM7NLExi46kvvH2zD-d74lR2aGqcwJrr1hpMYWzgaS432kA1odqRLQqRoeww7tLrQHoM7YzFcggWm2wWJrKBFejfvsyO2d-mQLsqPJ-RcG6wUxuFICYnZAxPX-YjwH-I0u3DDenipgY2okBStxxHu6PMYzIXpp6dKv_m6nmwmHhkKcWNW-8yGj2Ob2aaCjrRPkeVJ7dcOMkIFXP-mxR8I8YKIRPPZar5pbLvqggFLFWzXaV0NA64MsHfk1tQXyerQzOD3v3ZCXHcoVbEbIEdnicNhdWryO4TvUyJt0BpR9NXkHL7-rLL0dvkHVeUGZyZjkpjNkU3L8HDV9r59LG00KGfrxm3ppdaiMETA1YPfjRo9_oN-c552vk9PmoZPYOCIhblnOVpbEiTiByFbj7wMhWsDhm0haXJhj1lXNdHE-4IbwGP0Qu5jv2G2UYZM6v5ZR3ij2srho8Ch7jtxHsNpfATlknF8G1Ymy0FrF3zccJxXJmqg0sd-af2TRx62xD2pdk6kwnnLQxWjJ4T7NOZ72CZy4d2udUfki1B4ciQdky6PwwhCI1n-Gu7Xt-4s1_9eu-yE8ynKgHHYZ7p1oTvdkD0RuNNhwOIIoFmzV0m9zwrbuoM-qjy55YIC0ktFQof4-k1698WqqI0tElwpWsvoLOv_08wcHcWYR-pKQ-rhD78A_CS7D9dwEvjs9lv-JeXMGA2kpzkeeI8Fe8atmC2tLrxGAKrwN10190TBcEMHt4p3gl-TzdMZ7cyFqpElNjDL5Uwsz9OanPlGWLH1WIVk95MjX-cIu-qdXKcxo4i7rFzQ5us4Hvr_RVIsOoznd_Ym5SscRQVW8yDJoFaJ___H1jJyrEknXyJV77f2gDoN0_T0LP2YeNrgnvb-uRHTWgb2df8khbuaIT-bSLdn_QdtwOOsH2gfQeK_LagRXMVQWlceoUsTgJpulIgmSZId87N7PY64FByhHMPfePfgTCTy8wI3XbpZIb9y8A2fFuWVa49K0PAywMdJ25-60akpcRCpautWq9_kgQ6ubSaBTFbPSxmAXA54-sUjOh8sOWA-wbNdoa8d4DKIYIG7N8H1gu16bnYcJXzw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900010.redintelligence.net/ Frame C43C 0
150 B 40ms
16ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/viewability?s=13762700138580904444554012602010&a=b147d58a&vb=m
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=13762700138580904444554012602010&a=abb27e08
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Papenburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/request_content.php?s=13762700138580904444554012602010&a=abb27e08
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame C43C 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D536 43 B
215 B 675ms
353ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ac1b1aec-4855-2669-8e69-e092474ae536&tv=%7Bc:4pf1Q6,pingTime:-2,time:211,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1027,beZ:1028,mfA:1030,cmA:1031,inA:1031,inZ:1033,prA:1033,prZ:1043,si:1048,poA:1049,poZ:1069,cmZ:1069,mfZ:1069,loA:1182,loZ:1184,ltA:1238,ltZ:1238%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:211,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B207~0%5D,as:%5B207~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h121%7C1h13%7C1i1*.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1j11%7C1j12%7C1j13,idMap:1i1*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:21,sinceFw:189,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame DC8C 0
150 B 33ms
12ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=56147900120536004444554012602002&a=80f29715&vb=m
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=56147900120536004444554012602002&a=830e4414
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 Blankenfelde, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=56147900120536004444554012602002&a=830e4414
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Date: Fri, 16 Feb 2024 16:32:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame DC8C 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7B44 43 B
215 B 672ms
355ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ae890cb7-cc4a-1137-b06d-ecfa18a45ced&tv=%7Bc:4pf1Qc,pingTime:-2,time:135,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1119,beZ:1120,mfA:1122,cmA:1123,inA:1123,inZ:1125,prA:1125,prZ:1132,si:1137,poA:1138,poZ:1152,cmZ:1152,mfZ:1152,loA:1214,loZ:1216,ltA:1254,ltZ:1254%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:17%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:1,slTimes:%7Bi:0,o:135,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B130~0%5D,as:%5B130~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esT+11%7C12%7C131%7C1321%7C141%7C142%7C151%7C1521%7C161%7C1621%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c21%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e21%7C1e3%7C1f%7C1g11%7C1g12%7C1h1*.1712834-75654858%7C1h11%7C1h121%7C1h13%7C1i1.1712834-75654858%7C1i11%7C1i121%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:1h1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:18,sinceFw:116,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 57D8
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/&adsafe_url=https%3A%2F%2Fcsgowfire.ru&adsafe_type=y&adsafe_url=https%3A%2F%2Fcs...
https://static.adsafeprotected.com/skeleton.js

17 B
467 B

20ms
20ms

Script
application/javascript

2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 03:21:19 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 12316243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: tpnUJjRGPJXhDABzHzCPAJnLByDE7GVmHogdIC76X1Z3WFXgSZyIVA==

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
server: nginx
x-server-name: app19.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame B63F 91 KB
23 KB 21ms
21ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=6994398936&adk=4055225262&adf=186277472&pi=t.ma~as.6994398936&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119581&bpp=1&bdt=741&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1112&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=1261285418&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 10:50:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 4426905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 7iNxaB5jXTXp246jNeyIvxJYQyjCqdhIBtI4yURKHjHnDBQ9jLQ4BA==

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 9C3E
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/&adsafe_url=https%3A%2F%2Fcsgowfire.ru&adsafe_type=y&adsafe_url=https%3A%2F%2Fcs...
https://static.adsafeprotected.com/skeleton.js

17 B
466 B

23ms
23ms

Script
application/javascript

2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 03:21:19 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 12316243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: h5s-nd3l7aGQ-JoTd70ZzU0LGdYV98qMOOoNDthxkKWyXEqijEOMMQ==

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
server: nginx
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame E54E 91 KB
23 KB 21ms
21ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3825007744&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119672&bpp=1&bdt=832&idt=0&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 10:50:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 4426905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: _zSQMeVLpmkWNhUDPrpmE8YNK44b_0rropODnpV8dOswxdQ2kJuwAQ==

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 443C
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1523526/72529856/skeleton.js?bundleId=${BUNDLE_ID}&bidurl=https://csgowfire.ru/&adsafe_url=https%3A%2F%2Fcsgowfire.ru&adsafe_type=y&adsafe_url=https%3A%2F%2Fcs...
https://static.adsafeprotected.com/skeleton.js

17 B
465 B

22ms
22ms

Script
application/javascript

2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 03:21:19 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 12316243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: 8KNeyriuqP6tjaAqpONTkoywFlpc0jI3D2qBnUpAvP2efFIHaY8Y4Q==

Redirect headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
server: nginx
x-server-name: app07.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 791F 91 KB
23 KB 21ms
20ms Script
application/javascript 2600:9000:2127:ca00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=8431291308&adk=504092032&adf=3464753367&pi=t.ma~as.8431291308&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119720&bpp=1&bdt=880&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=1283&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=4&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:ca00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 10:50:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 f3303a5632dc925c26253530523fa328.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 4426905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: aWjKnrhQEwKOjUeQdbFaYYTQ_a1tAGWF7w5GCPJE9GMYFWsiE3noAQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 57D8 43 B
215 B 512ms
360ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=9b735dad-9886-0f5b-3f16-37e9d5bf8902&tv=%7Bc:4pf1SR,pingTime:-3,time:386,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:331%7D,%7Bpiv:0,vs:o,r:l,t:386%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:386,n:386,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:331,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B63~1,0~0%5D,as:%5B63~300.250%5D%7D%7D,%7Bsl:o,t:386,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B0~0%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13*.1523526-72529856%7C131%7C1321%7C141%7C142%7C151%7C152%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:13*,rmeas:1,rend:1,renddet:IMG.qs,siq:332%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 57D8 43 B
215 B 502ms
351ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=9b735dad-9886-0f5b-3f16-37e9d5bf8902&tv=%7Bc:4pf1SS,pingTime:-6,time:387,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:387,n:386,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:331,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B63~1,0~0%5D,as:%5B63~300.250%5D%7D%7D,%7Bsl:o,t:386,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13*.1523526-72529856%7C131%7C1321%7C141%7C142%7C151%7C152%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:13*,rmeas:1,rend:1,renddet:IMG.qs,siq:332%7D&tpiLookup=ao:csgowfire.ru*&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt05.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9C3E 43 B
216 B 323ms
177ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=37e1542a-5b10-dc34-4b58-05b7f41867cd&tv=%7Bc:4pf1SX,pingTime:-3,time:391,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:345%7D,%7Bpiv:0,vs:o,r:l,t:391%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:391,n:391,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:345,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B50~1,0~0%5D,as:%5B50~300.250%5D%7D%7D,%7Bsl:o,t:391,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B0~0%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15*.1523526-72529856%7C151%7C152%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs,siq:345%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt23.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9C3E 43 B
215 B 504ms
359ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=37e1542a-5b10-dc34-4b58-05b7f41867cd&tv=%7Bc:4pf1SY,pingTime:-6,time:392,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:392,n:391,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:345,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B50~1,0~0%5D,as:%5B50~300.250%5D%7D%7D,%7Bsl:o,t:391,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15*.1523526-72529856%7C151%7C152%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs,siq:345%7D&tpiLookup=ao:csgowfire.ru*&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt12.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 443C 43 B
215 B 494ms
352ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=7b251745-a4e1-9e8d-cfdc-ba03eb3f3cb9&tv=%7Bc:4pf1T1,pingTime:-3,time:393,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:352%7D,%7Bpiv:0,vs:o,r:l,t:393%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:393,n:393,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:352,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B45~1,0~0%5D,as:%5B45~300.250%5D%7D%7D,%7Bsl:o,t:393,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C153%7C16*.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:352%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 443C 43 B
215 B 498ms
357ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=7b251745-a4e1-9e8d-cfdc-ba03eb3f3cb9&tv=%7Bc:4pf1T2,pingTime:-6,time:394,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:394,n:393,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:352,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B45~1,0~0%5D,as:%5B45~300.250%5D%7D%7D,%7Bsl:o,t:393,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C153%7C16*.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h11%7C1h12%7C1h13%7C1h14%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:352%7D&tpiLookup=ao:csgowfire.ru*&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F05C 42 B
64 B 42ms
42ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvMQyChkxTuLVmAmsTVu3iGSefElaMsDRCFQHp88-vX5mu7iE9gId2Wl-LGY1oWpEf5diEt1-CEESRdpipFHoFdNTl6_v7vBsE2-lYnB3buCMLTGxj2xZYusYkTKmzAQWCRcGb4ZFWeOG0PrljCroRXkf4FyIbWBKeqXg&sai=AMfl-YRRPn3Ui9JwB9qi4q6vy7S6tT_w9vr9Gmm8U8n96FCU2DNcGOZgXcBTpt3yfoeDTmpebv46EOduYGmW2UfZf9zLNLbWl_Ysdj2lmMmkXcPrxsfSqXp25JP-WVCqp9hPubUoQWyjSjwJ9-M6QLHi3g&sig=Cg0ArKJSzNP-YjJzFLzPEAE&cid=CAQSTwAvHhf_MADGL80BEuS5A87_8Dx7lr_ed-JgwKVMmSCV1qf2wHo5Yfi0gk422n7oUUbMZ_ThNwUnEXGe3fWVR7ubBEaLKbz72azsMSy-J-UYAQ&id=lidar2&mcvt=1037&p=0,0,90,728&mtos=403,957,1037,1192,1224&tos=403,554,80,155,32&v=20240215&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=403392000&rst=1708101120506&rpt=152&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E016 0
22 B 42ms
42ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BKuU7AI7PZZzZIcat9u8PuqW2OAAAAAA4AeAEAg&bg=!oKOlo-zNAAZN4L4YbeA7ADQBe5WfOEDsn5yd3cK55zllTZp2-pCVE-lOZzLp48i8kxroxT9Yyxj4OPXr5OCPYjmn_SY8AgAAAchSAAAAAWgBBwoAGvlZ_GKDxfbo5mYkcOfFYdxhUFDLftVFQN78mQL1iXxRBRofVw4sE13Go0_34sqzO-DloHNCn3GAbN332ki3yid2q2KVRdLt-ZIVvavOxZJ754f4eEMZgy0gxTI7_jA569e44E5ITZJrEZLFHvPrBj6FSxONjRt_ro-gcAx5SPykuVfRxQAiHw1iJPSkJl4z2N61W9yjHDOnfAeAeoDwY6tnfCdsmDRPaVF0ze-L1w46RYmpyS00rTYrBz1pJrc86WZQmOjzcWvXlkA8eqhsAx4TEgiXId-E3oZu8t0WYXts60tKd4tZnS2xF8VlNBU-Roq6weuav4cRuWXSgqwWZAeYrFTJmGBUmpzI6PitWxYgVnNCHlAAdG9sLS1LpnJXOqCZAafHAWmAVqU3PXPxV4PC4rPsDu_kDJtZO9a9LTRur6a0tPF5LdNOOvpgqvEe9M08uOy7VhdiWg3O2brglfbM9FmdA4ro4e1gN6J7iHF5Rc82RYvxyqGgWnNw3GVEK6N0au4NaG2BjNOf5jfB363O999jH-oKxIB6bv5Joxm3hMDY7nCHjcL1J637eTrqpWHXMruxrmQy9bCalsNm7Ze_18lxmzbC-o5naBl0IAAFldnAAnFhPvM9MgZVKJ_tAAyLey6yhlctgAkzJatGlC_MFa5RN_fmfptzmKnte33pkoM3Tnqqhf4pK6MamVY2QK1s5rF8WiKerC9ZgOmxBZg5oJua_PUmvHLyJgpyuHRB67xyWO9c8KQ7xj1GDJ2V5dlI9fDKDGN9mGfjD8a_KzWjp_ZfUlzho_k49eDFD0l1fVcnW25YJOhr7jsiUzfREFh9pQ9bAhMUDBe0hBFeWlgyeo979c35o4XWCCetOhXkU_iDo154e8sqpUgMx0u4YH7iHTuDf8_05sfpQAgB4GAQLMA3xkeharjiVOxYU8rED8UBUIP2ghz9uDplQUCmLucUotecBRcaS69lIGzDMcxoCdS-6YNoTaYG7tw4vY3VPcsaatyPYGsI7on3QJtdRYRDlqr7BX9MUWDHT5-CAh7Zew

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5909 0
22 B 41ms
40ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BiGT8AI7PZYjWJMufx_AP9LCcqAcAAAAAOAHgBAI&bg=!w8ClwI_NAAZN4L4YbeA7ADQBe5WfOBNv8JWgbG8Q-XH-ve3VoM2HppqV78xGgJCmCaMbsVqRWFeanSB0Q9qgoyDnbfPSAgAAAcVSAAAAAmgBB5kC6MdYa1inQlMpjEB5oSQk9AQPZVfH3E4F0_GHqUTsW0rDoZtPweI6QXSml2dIQO_lhg3x7QAAcfQCNPMEDY4lTATQbdTu8nbnk8dT96cD4j0WVNRg7TYpgAQl8I3iip3ajnnHScWeHSez0e_BYkK-p-7dJI8qW7BVJVrhLPJWF8IBKGZPeFo_Ch8r5ansk3pLazIlReMwACek-hfCBw0MwZnhL8zWeHbsPHj01onh1a63dGf4LPT0jcQB1TU-szD-zwN5M1DhYdS9Zx_tJlzThPsJpXg7P75tkY7XmtXRvCQfrg_CykQXEw-iqAbUv-gNinHFtpdLbd_-AYtcn_JurOZuzOlzyUmeh3QRtoTIvCJZBFIFRDP7oF_uf7sGJUbY8h0a1FlUQWKfVdWvUAc_BWIGOH6nYNP-_RBylgdbNNBGUTS5yOle99qBIm5Veezrc0hByZVU_yglvl9Hpn8oiOE7OHVqcqoZjC-7-zUwOsZpxWLcudJ-Vz2SUEwKlbIIYI8Q4n1TkTaBO00j7HH9HsgTYYEXjYO4OZTmecjjtbvGZ68bcpJ-JVypy5PK8NXflwFuQueARmP2LKI5_c0PQXFnPLvXv5NQoIarbFVpw_tkUlMzSmcApSBeTkOSQpCuvtjqYfx-Fhb3ZfwCFXlwjTqK3JwOt-5p5G25yVphv6LQ2ZQPcHqQorXiiBnEGwzR5pS0_r_vSaSB4qW0pIyDFhESe8Bxb4q7Y-wGb9nGS3g7Z5coTB3QwvqzrKAax4VzqKfobmputMxPYwhP2F1mTOZZA-YA7fBdg8_w_JjW-iJQQV5pUKv-Tg-Jgrgim5FiVu0CUq1F5G1J4pwMJRb5G4udTWcBkHrjHF9syyrWnkYWztnFEp_zDOuLh-S4yx7kyumbaOKB1SDlDSOGT-0tg2s2DCvz_Oa28NgR0PZziEywwGo-CrdrNw3O5-UtDaqzHsdQbLdaC_m3jffgNBkpVV3KuIuKEkcH-A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1231552721&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119774&bpp=1&bdt=934&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=638&ady=2906&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=10&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BFB1 0
22 B 41ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BeOj3AI7PZdm5JO3O7_UP4tep6AoAAAAAOAHgBAI&bg=!kZKlkt3NAAZN4L4YbeA7ADQBe5WfOMa4Uv5r19NCnvVhuwSH-DA3VMeq2b6NsnyIpdTppw8AzehWZFl3pzGWL3v2cIkUAgAAAcBSAAAAAWgBBwoAX_pzWWkbnAyHbuS51lnukTgqYg7TegxBRAQ33ocD8pNcmFJWffC30FmIprvPFch8vzryG_IsagYwb5d1RCkiMDbPhJ96i7VVImNcMzd8CXkOq9YOC_PQqAIDI5Iw33CLmQLd8si_QsFRA0CtNykplUF_2vYFffO_Sb1BeHI9qIj4M6wgs7xSj1T0M-Q9pv5MBNAsaCbbjuoR5JI1PEFhJMp9H6GLCDs1bSTaFDWoNa1TF0XKo6WhzYbjuB53nPBG61orzrOLrAA--rk1LYZnHH7lBi54PKz61s01JBijrMlYC2vUuzOvS87XQOzX-EmpOH46UISVxeApQ_CRhQqhobLv7Oqde46GeqPOSTj4JmvDYu099YWB3IW9nwh50i1VJI88Tze7XG770a5vl5Vhheer_Bcl5gP-9tJjoEFlFuVjGPs4USaL4KjuZmBnGN8EqVwxSd8g6lPzyUctCAwrkOfIkM7GR_8JXsWCISRV1DaUE4MjCK9SYtOTpLijijL0IKu5BNhoSHpwPDyksB7pnAv2SeC0GFER0VrF8m1GwObDFqFPYYPnxc9Lu7qnKHnQ5xFazAceIOFEfHE_4a0_P-C-syGX7oO5cjuGW9tccFrguVnLdsvVbIYvrnV8qn-uLmoTsw2y-nQnxihHHscsT_CAjUnP8WmaaQ352U7SRQtNQ5gpIV_aFGDtVwmZLH5Qa0XF4C1B_l1vdmtFiC2rH8qk9QVwqm84w-hWdIdXe3VD0XTkwiKNVwBo841676VsuW6p_XvkTP_Dw0td6q6k1eoRPj5uS1hjQMVfiDAmOO1MACfTgt5QYE3t8K_0OGCG5gZk22VbmxZaGCbTbqtSRkB33vrkLu6XC6gqFlEQTNQoKicSx5NE5H7Dq7bD8l5D6ue27IFrl81k9lEdikKz86NKlkMqTBJxv8sHxDIXMdr67gQbBreY0QYiFzbioXDZvGYtKC7B9WeXJcrW9YjzUjqnZtqA9R-Poa9rtqM37Z-YK9yRBvgI9ZNfuRWbZTq7poiTm6BPMfTMqUPf6rmMF4t4K--Z4BoRExbBI9ROVQ8nCiyIuh3VBQ-6gSALuq8YP2JeETFA5JTlqmXisbRvzA

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3177 0
22 B 40ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B-aAYAI7PZdmGJd689u8Ps_C3-A4AAAAAOAHgBAI&bg=!GRqlGlXNAAZN4L4YbeA7ADQBe5WfOORqLPcFXsFPo7lUnkywNUV0yiotwOCtnq4n17HPLfGqoKZ0hNvk8xTyt9qDeGOGAgAAAb1SAAAAAWgBB5kDCK141yK7wbCbOSqn0WZ2gHOnic2UuALHJyGwj3Z_zFxFQOdEKCd2Wn3nG37zWoqpAaFUOnMsKcXfWfjNriQVlUMicT62Q3nl17Pps1I1ZHh3KHoGbB_gNvxOYm1B_-6qzDfY7CL_BskrX5Lfweg_3SOADVI4BaOSSgZ9B9wtPmFhIvDIas9M0SThv1Bi59epuEkDYOZXX1m-HC8TdBuT9wE19M1zYs9fQNWMO0KDa_kTl21tadhxtXOm7mUHWY1TLvtPVgoOx7TRpS4S9cESxWsHx3_GWDdxt7qGQos-QTNevvbMV_iqzqHpzxlfu6dmzO_r89Fs_7w7CgPU1eCDeb7IoQbt3f-JmzfbqEPSHl13vGmntjKle2RDt3anXUQa19avYZG4bPWxTeEn3xzQY6nuFr4lx7qnBUNQIufkrXE3X4PH9XhRCODiEDuoAwrb2Z-lAcMI1gcZM6yo96Se3jwy8uVFzZvuTe2qBLtqox7IGOC6VK7vurkKUQXTuJ1SGIF85boEURaBA6TDVXEq7ezAIw82PSSWLyjUmeKFKQ8LT6QIE-IxYDLQ_Ln9lvd-9q-F6pGMZ20J9FMu9ybyi1PQexvnkeGItEjHYLoTs4hjuOFMSfs4nFPKi6ZvaI9SPk-5N4G-v9h8nBnzUo_InsnCuddblSW-adRBwrHjMKOoW8CmNafym0ReupK7J_DBjVx6Owz7cp2-SXweHfelYfKQlsR9CpN-2ju9nfial-tyk4P5CnIdsWitnhyIuTVICz1UBG7bb82oQSOV49Wd4WaFtXW3AHPZ9x509w9pGzw5gM-O5eXP8bMoFni2r2_CNYtmGe3IGJLSdsIj3R10MNcKZptucNJjiwLHPWwX5jrtTxthSmGb0DBN8RPc-cKPblTD8op_8VUasU1Cyr1jDayfwh3az4iBoTjxGDLMZwzbofTpiNzH82LzpChGtOa0tBLklvFQJD9_8-pSKWTD1bZiFx6etqQj6XAKp9NSNJnv3ZyqkeJ5UEcmnARcUH_11Sbjr-bsrXmv

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 091F 0
22 B 38ms
38ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BKh40AI7PZYapJLK59u8PoqaSiAQAAAAAOAHgBAI&bg=!KyilKGfNAAZN4L4YbeA7ADQBe5WfOGOy5hVu66ZMnOfYuMcNqxuE7YSEdXVWf_7hdeoNKndYAGA9JHpSr0foXVv-AjE5AgAAAbhSAAAAAmgBB5kC4bxrzfbp69n-TVnlIif1sahQVsem2s3co0ENpDIAGyBTTEbt8Rf2q8paW6I6k9FdONtCfvdfPn0ETFHXvpnRUZ_Fv9_9j_yPMg8bGvEEUN8FDh8JZyEm_4mbH9Ee-6nu6E_CsA5Rs8XHyHQwxnXqJ_aLyH2QWIQlLPBIWFYhI30QZJTCUaAVpDRQUNgNQlY8tNKLtL7WOYRLs0q16xxNP39IbB8ylCzviokYJH57oiRCSXA1BMBMWig7_r3NOZI84Zkb43ZHpzN38FKOaKAMfwCdoLiFxy1jCbbZVg02F6U8tv8V4wnRIHMi3yL4AAl_iSwtXi6F8F3etwby4_OtIzimXnNPsawSipIv6QyohFutev2iM16h5MBmkLtTNFLMCTMWZJ_g4z2wGKhlhp6YbWHETs8oXVG0M1SHzt_UtHeyga7Y4pipEiVXlO6wko6luB_cVWO5lZp2MXETC6My9fyvrZy4wbY8qWDNOfIvKOSjO3amnLV39IZZ35vBbf3OXvhCZrX9PZjKQe1q_sCBg8YC9oXmxUPeWpca1KAmZEXMuNG_dBC0dX3f8ZI7WBTRv0QIT02sa9bcTFZ8-BY1_0WR4Qh7_CajFRPAQIC4rQGtjL7jBb-mNXMNxjPrnDPwHueFUivyVt3oLi55nnpV8ggdVpUQ85K5w115Vc7MhlsjWbL_09qC0eIF2y5DsMZNu5QAjrcfQljeh3SkQJ0jPknMpdLUu4Y9IBABL8q1L0sNK0DzA43JCF_o5_OR3pLMy9qmNfZ9PRrfNypz-Yf3UZPRrvuGIEr28ZX-C8KLcsmPYFwyZMT4997gbenIHUNRPSS0tX60VuH-Qu6cXR5DOQ_pIRMnNQ6s4tCLsNJriAJid5ORMLEbbHkQndBO16hnQoO0vzTCyonRwMJ_18G8Pu5j9L8Hzf9OpoLYSxzx_vOwiFoDsqitPZDkSelNUk7WShBdO4p3mGTUlK73U9URs4p9

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 57D8 43 B
215 B 484ms
357ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=9b735dad-9886-0f5b-3f16-37e9d5bf8902&tv=%7Bc:4pf1Tg,pingTime:-2,time:411,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:1152,bdZ:1753,beA:1921,beZ:1922,mfA:2242,cmA:2243,inA:2243,inZ:2245,prA:2245,prZ:2250,si:2253,poA:2253,poZ:2262,cmZ:2262,mfZ:2262,loA:2308,loZ:2309,ltA:2332,ltZ:2332,mdA:1922,mdZ:2060%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:331%7D,%7Bpiv:0,vs:o,r:l,t:386%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:411,n:386,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:331,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B63~1,0~0%5D,as:%5B63~300.250%5D%7D%7D,%7Bsl:o,t:386,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B25~0%5D,as:%5B25~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13*.1523526-72529856%7C131%7C1321%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C16.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:13*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:IMG.qs,siq:332,sinceFw:79,readyFired:true%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9C3E 43 B
215 B 482ms
356ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=37e1542a-5b10-dc34-4b58-05b7f41867cd&tv=%7Bc:4pf1Th,pingTime:-2,time:411,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:1021,bdZ:1643,beA:1833,beZ:1834,mfA:2173,cmA:2174,inA:2174,inZ:2174,prA:2174,prZ:2177,si:2178,poA:2178,poZ:2182,cmZ:2182,mfZ:2182,loA:2225,loZ:2226,ltA:2244,ltZ:2244,mdA:1835,mdZ:1955%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:345%7D,%7Bpiv:0,vs:o,r:l,t:391%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:411,n:391,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:345,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B50~1,0~0%5D,as:%5B50~300.250%5D%7D%7D,%7Bsl:o,t:391,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B20~0%5D,as:%5B20~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15*.1523526-72529856%7C151%7C152%7C16.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:15*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:IMG.qs,siq:345,sinceFw:66,readyFired:true%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt10.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 443C 43 B
215 B 479ms
354ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=7b251745-a4e1-9e8d-cfdc-ba03eb3f3cb9&tv=%7Bc:4pf1Ti,pingTime:-2,time:410,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:1058,bdZ:1619,beA:1787,beZ:1788,mfA:2134,cmA:2135,inA:2135,inZ:2135,prA:2135,prZ:2138,si:2139,poA:2140,poZ:2145,cmZ:2145,mfZ:2145,loA:2181,loZ:2182,ltA:2197,ltZ:2197,mdA:1788,mdZ:1935%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:352%7D,%7Bpiv:0,vs:o,r:l,t:393%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:410,n:393,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:352,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B45~1,0~0%5D,as:%5B45~300.250%5D%7D%7D,%7Bsl:o,t:393,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B17~0%5D,as:%5B17~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C153%7C16*.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:16*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:IMG.qs,siq:352,sinceFw:57,readyFired:true%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt26.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7AC2 0
22 B 39ms
39ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B0VdrAI7PZbO9Kf-t9u8PsKaywAwAAAAAOAHgBAI&bg=!UFOlUxzNAAZN4L4YbeA7ADQBe5WfOO-BVMgJX5_xz5lsT4F6mezg5ZGq3tzHj1RvSR-6gRoVGDw6wDHVUraUdpY7Hs-vAgAAAbRSAAAAAmgBB5kDCygZi4qWrpxa6NJd8D7LBHVwDbkUeRA5cUvp6HMS4tLlxoAoRki-wGHVl1nzyWlEMMk65Oas2_4B7VYSQPnD3YGWDz96bZDePdre3VET8A3etYOz1C-iHSrlQB20zH9Zx5gCYIQ-uIfrrbHvSG47esaUh9bfVaMwuFblYxVV1P2_C12_6kAbAjKfZ4tnbBcOP5SBO4nPNx0L5IErKvJugbnRdT9Ioq0EDmXmkJzah67Itweg3hEn6h8RSDD1FNXSdcb-NDTc7v5rR5jd8awrvdUZszs_PTX-8MnoguG1AVVGIgxJjCdWzWyMncZxa-UlqA0q6bpgFyVQIBYLJfrAref-YLqZYzu9VRknd5YttGr43Kd8Lc7JIk04xyurIGTyCoMP7OagJ0taaJO0Nrq1EJ_A3Q0XgxMw44C0SK9M8ZTS8FlgbuXeFS4otHjzXFOWCMBo_LL46Yre6qBxGKJaxeDUR7NxLidJxwtHHs7_7PBrU2Sj4YDR4gq58uoIaboFllLqUf6oE1L8thhTXpJMmV_2EoCGopYsMMfph7GdqXVrHQFcVo2RnhZIq_Qt0gnd7ySs4cjCrB3jvqTtegCsS_40bj-cFln-4y5lNnj5NGu3LbXHEU0Upvm1zVudFukBI9CsL_Ivvbdcw_QY6XiG5c40xFStLn4PDInSDQryZIkuHsrKvxo9oqWbAtza7Q8HdTzwyS3CByD5k4LugGxDFpYy0NbRui-axGko4EW9fP4NRIuWsg44jAfFD1aHtnH36PyI1qNgrOQZx1BS15eDScQOupg3VfmUH8Ke1HDN4NnmfxG1IeMehLttf8geMwiU-kwbAQMz7wdBzXA5lOPfMhH2M0mCQkDJuYxaCwOI-3NOAhq38NLP--XeiYIXi-pCZxmu5MY9_L3n_XXoldRJp4T7dB2LjZNB9Tx53wH2p3kfbmuSuSy35sMuP0QfmGOMAvw5os1-Z3w0tUpUbTKwT5uhF461ZrnuHjsQnxpGUeQqdLFX1oSCx8OMcwPfQBpogvtxoyhIHn_-QwtB

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AFEB 0
22 B 41ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BoKMZAI7PZbaZK8L-9u8PqYWHyAsAAAAAOAHgBAI&bg=!iYqlisXNAAYBC1i-IQs7ADQBe5WfOL5_sWMZz1zpZGfECDsHmvqdG_PbGTtnCOaJAfcyAFfZuYIBFhFRW2o01PLfXgVnAgAAAddSAAAAAmgBB5kC7GKEi5teM1lw4lNi9MJhTHhcXCQe7fjoJUitBCZmBe0C-M1Sg3ZTIRPKjdUH2vbgGoKWq1J1dQufHC-dLXFbo9MUwvAq5Y0cCPrR4057r6XHFGz9kN8F-0oDQODnlV88X5h3X8oCEeOS3lx4Ra6LOpk41wzZ7YQUTAoX3Tp64Bw40ljncBBYWvhiIUJLk_WE9L9hEZ2QyXeGCOLlf3aXbBtCX2tTruL13oe1FactjssuHOgMQOfcmjo0a_kB4ocOgq6sCJbvyM1cD3b-SXpTDQbQ-d8OyP6Cm8rQY78S8nXKk7PMvOsChWXccYxEuL5OfK54j_OBnTDDPfEV7OIuUEZo8IM4B3jkF4gYOjCNn-c4DTpvvaEq4B1AIfxaiKVxaMxfumX1lcST-Q8rCnO4B6LT9X4k6qIXDD6PfVJTSylTbEWi_F6IXBOt6_IL4J04uirf7Vb8MEPy1D8-jEQIULt1haRn8nypuYHy5NyXa7P0Pzr3_tCGwJJUlWtOXkIjuJ8GRqVA2J5hTMagia07HMCMZURYzXyu44Feb-0-qCUS4RpOOsC3MraoLVlwFlu9x3JsujvO9dLdUkq5aDdg57fDLoUZ7sqNB9aZqLMZTNtm4Snz5bxV9p_3sVQHmKMj0DoVmGS7BAjdP185eDKR51qhcJY260NNe471eY_MERvX3qtzsE19YP5BwyBU771cWR-XOaU7Hs4fQYs28AQF1xOXE-pXoXomVlH1m9IUOD6BOcyd7w_Gcl1FvUOwRoYS0fzLMjEKLsyshA278AiI82jw-7bjsluNZdLXOrLqmaIqQiH-C0KlidO5cmh5tI0ugFgChr9dK0-e-CWqn719pPQX9f16FHQxdiHJ40hZ-cHmVKDk8D4QeiGRKW2jsdxgq1do3BPoWqSt0V9lOSI9E90f5t6JDlfgVUvG528YtuDSZfRjNgtXiOqCB4sCHIXefcpgZw7aqLJ6ParzEvmRAaBCP3qGEbE_-yBPcDg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9323971679203656&output=html&h=250&slotname=3025607330&adk=3272298798&adf=1217122582&pi=t.ma~as.3025607330&w=300&lmt=1708101119&format=300x250&url=https%3A%2F%2Fcsgowfire.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1708101119781&bpp=1&bdt=941&idt=1&shv=r20240214&mjsv=m202402120101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C300x250%2C240x400%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250%2C300x250&nras=1&correlator=6775510008283&frm=20&pv=1&ga_vid=1334585465.1708101119&ga_sid=1708101119&ga_hid=520851070&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=486&ady=3162&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44808398%2C31081035%2C31081187%2C95324580%2C95325068%2C31081168%2C95321865%2C95324154%2C95324160%2C95324435&oid=2&pvsid=3931450569834711&tmod=860080654&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=11&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A198 0
22 B 41ms
41ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B831DAI7PZeqtJLnE9u8P9Jee2AsAAAAAOAHgBAI&bg=!JCelJ2jNAAZN4L4YbeA7ADQBe5WfOHTgSJZ5YdxULLJKeOP_iLWgugbzvNIy4uhecyFoWM4wBth4u90hSWw0WKGjZQAtAgAAAhpSAAAAAmgBB5kC9OY6A2KuZviax0v0GdJxH4a8lkeotZZFguWyq1_ONQpnjA091uFrwcD7XZINtIAm-t6HiKKwwxMBo3PXgETSed6Ab_N8ov4tVVVVUxdVYcmvDN8V4H9nG5O5NKSuAPttnd1GXZ7aXiUnY9G_VIF6kHeaGNoogHtCK2NVrpcsm55emuDuWpusKDHsezacVjHKDZlvSfjH_vtKpDhVLlAdFXcRGJhJKmW6SrO96G2rn9IaetCSypgtR4OXGvl1iS73MILRbNrO-Y7CSag9V-FedZcMC3Z0s6CbFCLVQBccFQWSwTa9UD4QictoM9pOVTU9Wl_uAqhM2HBe7vxkumOzj-Bl5ZdUR_LOkHYyzz-Rk9QFhq2K6SqnHb41GdQ_EQFjYfk-c9x77pz9ezsVI-gPU6PfJedfxTDhh2elEsqAGKW4iT0imtgXzK5RddH7SOAziTxsO9LGb1lkrypfi_VdyGQ6I1yYNEz3LxXRPRsfb4uoFPPAp8Y8m4tfDBTPu9fn6Ydue6g46xQ2SUZXNR6BXWz3cgOenUjM2gBIBqazh6gQuniyQIUdKCV1s_gTBz9yDi5ZC7G9Qs4-o5ocVQkm1C0IXYH1yvKGAteFCxm7rwIq1qimJSDefqax2zyPHyxZS0UBnqTasHyRgf8wCLdKtgCOFKP91IoEwe6EFh4CwnA4WvKTa2wS-IdqJnuYwxOwjPw7w2vHbJndTv_ZiD-A-s3ZmOwN4BFPYAD6q5_KzobwqbD45MlknHOCH5RU8JbdMhwyiMtMmQ73sPH4tMOqnWwOi8rDJ0wwke-WrN8Bq8G5B5jITQbUZ-J0n-bunDuKuV6Dx5EskmTIpAJST2H_dWBNlwSr79hUx7n9KsrOeO1UC1IKJggcig8yq9ZsiofSG1WU79XgIUteaIuN7DaQ1_-ZgPA2ZRBpUPnq3D2OBaImbzsq5LFEbBQDpTIdwxvwIZECf0zNe2Q3cQIOf0VMA2AmC5eQ_doTOZjYw2aWKCFG47TT_w

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 57D8 43 B
215 B 261ms
179ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=9b735dad-9886-0f5b-3f16-37e9d5bf8902&tv=%7Bc:4pf1U0,time:457,type:e,im:%7Bimprf:%7Bttecl:1201,ecd:99,tsecr:1%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:457,n:386,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:331,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B63~1,0~0%5D,as:%5B63~300.250%5D%7D%7D,%7Bsl:o,t:386,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B71~0%5D,as:%5B71~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13*.1523526-72529856%7C131%7C1321%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C16.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:13*,rmeas:1,rend:1,renddet:IMG.qs,siq:332,sis:432%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt05.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9C3E 43 B
215 B 431ms
356ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=37e1542a-5b10-dc34-4b58-05b7f41867cd&tv=%7Bc:4pf1U7,time:463,type:e,im:%7Bimprf:%7Bttecl:1245,ecd:88,tsecr:0%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:463,n:391,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:345,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B50~1,0~0%5D,as:%5B50~300.250%5D%7D%7D,%7Bsl:o,t:391,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B72~0%5D,as:%5B72~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15*.1523526-72529856%7C151%7C152%7C16.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:15*,rmeas:1,rend:1,renddet:IMG.qs,siq:345,sis:433%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt03.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 443C 43 B
215 B 246ms
180ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=7b251745-a4e1-9e8d-cfdc-ba03eb3f3cb9&tv=%7Bc:4pf1Uf,time:469,type:e,im:%7Bimprf:%7Bttecl:1169,ecd:86,tsecr:1%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:469,n:393,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:352,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B45~1,0~0%5D,as:%5B45~300.250%5D%7D%7D,%7Bsl:o,t:393,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B76~0%5D,as:%5B76~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u4t4esP+11%7C12%7C13.1523526-72529856%7C131%7C1321%7C133%7C141%7C142%7C15.1523526-72529856%7C151%7C152%7C153%7C16*.1523526-72529856%7C161%7C162%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b%7C1c1%7C1c2%7C1c3%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1f%7C1g11%7C1g12%7C1h1.1712834-75654858%7C1h11%7C1h12%7C1h13%7C1h14%7C1i1.1712834-75654858%7C1i11%7C1i12%7C1i13%7C1i14%7C1j11%7C1j12%7C1j13,idMap:16*,rmeas:1,rend:1,renddet:IMG.qs,siq:352,sis:440%7D&br=c
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt27.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D536 43 B
215 B 206ms
178ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ac1b1aec-4855-2669-8e69-e092474ae536&tv=%7Bc:4pf1UQ,pingTime:-10,time:505,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjEuMC42MTY3LjE4NCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1708101122016%7C%7Cbe9f50d71e4d1645fe337623f71ec003%7C%7C1605e69839cb81a076535f1842285622%7C%7C89c121be21ba8379b209ebdb77f909c4%7C%7C13268845669867a8e72010abe9fe434c%7C%7C206fe374705038b8a4ce11956d26ec53%7C%7C26622a4348ea07afacf5d7fe059c39f0%7C%7C1fdeca5984c9f4442ca42768a427099b%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 7B44 43 B
215 B 351ms
350ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712834&asId=ae890cb7-cc4a-1137-b06d-ecfa18a45ced&tv=%7Bc:4pf1Vp,pingTime:-10,time:458,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjEuMC42MTY3LjE4NCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1708101122051%7C%7C09a859377b2daa97a19dbb129b41ad62%7C%7C1605e69839cb81a076535f1842285622%7C%7C0bf66e0affdb350e45395cb1032dc1cd%7C%7C902c71e4e371f981a560283faa7b9171%7C%7Cce7cb327618989db705a4253619a0bde%7C%7C468d978c10b2578c806d3260ed6cc156%7C%7C7e690cc4c903645a6b743e0a6d36d1bc%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240214/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 bundle.js Show response
yastatic.net/q/set/s/rsya-tag-users/ Frame A7AE 102 KB
35 KB 52ms
51ms Script
application/x-javascript 2a02:6b8:20::215
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

6faf9b3930c127b8bf7d97f22a50832b6cf0ac678e16ba6fa412e0a5ec06dc2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
last-modified: Tue, 18 Jul 2023 19:47:42 GMT
server: nginx/1.17.9
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
etag: W/"fad15dadf56fc1d71be6b240cc30b915"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: abc3fff9717839cf
timing-allow-origin: *
expires: Mon, 19 Feb 2024 04:29:26 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 57D8 43 B
215 B 292ms
292ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=9b735dad-9886-0f5b-3f16-37e9d5bf8902&tv=%7Bc:4pf1Wi,pingTime:-10,time:599,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjEuMC42MTY3LjE4NCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1708101122016%7C%7Cbe9f50d71e4d1645fe337623f71ec003%7C%7C1605e69839cb81a076535f1842285622%7C%7C89c121be21ba8379b209ebdb77f909c4%7C%7C13268845669867a8e72010abe9fe434c%7C%7C206fe374705038b8a4ce11956d26ec53%7C%7C26622a4348ea07afacf5d7fe059c39f0%7C%7C1fdeca5984c9f4442ca42768a427099b%7C%7C1663701684,sca:%7Bspg:ac1b1aec-4855-2669-8e69-e092474ae536%7D%7D
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt14.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ Frame A7AE 157 KB
56 KB 146ms
145ms Script
application/javascript 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

a752b79139df1c0c372f1937374d3ee40f8f52cf2e08f354927fffd43134b15d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-de03"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 56835
expires: Fri, 16 Feb 2024 17:32:02 GMT

GET
H2 200 data Show response
yandex.ru/set/s/rsya-tag-users/ Frame A7AE 362 B
737 B 68ms
68ms Fetch
application/json 2a02:6b8:a::a
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/set/s/rsya-tag-users/data?referrer=https%3A%2F%2Fcsgowfire.ru%2F

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

1b21be50822c8f1e162a563f05543e3d8b2f97a91e6ebcb8064ebbe13c6037e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1708101122182823-9088534024618520137-balancer-l7leveler-kubr-yp-vla-115-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: public,max-age=300
access-control-allow-credentials: true
x-xss-protection: 1; mode=block

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9C3E 43 B
215 B 343ms
343ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=37e1542a-5b10-dc34-4b58-05b7f41867cd&tv=%7Bc:4pf1Yb,pingTime:-10,time:715,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjEuMC42MTY3LjE4NCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1708101122222%7C%7Cda2d76c289da2907caddecd05dcef6af%7C%7C1605e69839cb81a076535f1842285622%7C%7C693eb5d1748e3bd2a3c02e093b0c3c5e%7C%7Ccb8716a631536e9effc16d600bc9eb94%7C%7C510a2cc150a54ad480cdb47e86da1f3d%7C%7Cf630d5782862af8120b4f66c9eee85ad%7C%7Ce2c1c770fe0964788f6f3a496737d6c9%7C%7C1663701684%7D
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt20.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 443C 43 B
215 B 308ms
308ms Image
image/gif 2600:1f13:800:7780:9585:15cd:9c41:5a17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1523526&asId=7b251745-a4e1-9e8d-cfdc-ba03eb3f3cb9&tv=%7Bc:4pf1YR,pingTime:-10,time:755,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjEuMC42MTY3LjE4NCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1708101122016%7C%7Cbe9f50d71e4d1645fe337623f71ec003%7C%7C1605e69839cb81a076535f1842285622%7C%7C89c121be21ba8379b209ebdb77f909c4%7C%7C13268845669867a8e72010abe9fe434c%7C%7C206fe374705038b8a4ce11956d26ec53%7C%7C26622a4348ea07afacf5d7fe059c39f0%7C%7C1fdeca5984c9f4442ca42768a427099b%7C%7C1663701684,sca:%7Bspg:ac1b1aec-4855-2669-8e69-e092474ae536%7D%7D
Requested by: Host: csgowfire.ru
URL: https://csgowfire.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:9585:15cd:9c41:5a17 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 39385800
mc.yandex.com/webvisor/ 43 B
0 207ms
109ms Fetch
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/39385800?wv-part=1&wv-type=7&wmode=0&wv-hit=822589521&page-url=https%3A%2F%2Fcsgowfire.ru%2F&rn=463035345&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1708101122%3Aw%3A1600x1200%3Av%3A1241%3Az%3A60%3Ai%3A20240216173202%3Au%3A1708101120991997061%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Ast%3A1708101122&t=gdpr(14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:02 GMT
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:02 GMT

GET
H2 200 advert.gif
mc.yandex.com/metrika/ Frame A7AE 43 B
219 B 192ms
116ms Image
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: csgowfire.ru
URL: https://csgowfire.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "65cf573e-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Fri, 16 Feb 2024 17:32:02 GMT

GET
H2 200 3 Show response
mc.yandex.com/watch/ Frame A7AE 276 B
376 B 172ms
148ms Fetch
application/json 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/3?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Advwfxy7fhrjc20probge5wgr%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A0%3Als%3A323628007194%3Ahid%3A320285409%3Az%3A60%3Ai%3A20240216173202%3Aet%3A1708101122%3Ac%3A1%3Arn%3A30505643%3Arqn%3A1%3Au%3A1708101122585866858%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Ads%3A0%2C73%2C36%2C4%2C0%2C0%2C%2C16%2C0%2C130%2C130%2C0%2C130%3Aco%3A0%3Acpf%3A1%3Ans%3A1708101120068%3Ast%3A1708101122&t=clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

d7d6acc99bbc823a7da3fa64a34a2e8d1576d47d657bd00202e86a7327d2630d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 16:32:02 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 276
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:02 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 57ms
57ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240214&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16d2fac07f24c6c4dfd28ca0361b457322a272b233f206af1fa6b5b349a0fdb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12334
x-xss-protection: 0

POST
H3 200 11gku.json Show response
newrrb.bid/ 59 B
489 B 49ms
49ms XHR
application/json 2606:4700:3036::ac43:bc11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newrrb.bid/11gku.json

Requested by

Host: newrrb.bid
URL: https://newrrb.bid/11gku.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:bc11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4591a3e4c707a890c0b1eb584d375735e28fc5e235797293fce6f6457403927

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aJCLSU2i1%2Fo2tYbRLWmbGJtDw%2BVhsr84U0Ai0muKH6WkrGxtmWcCMLBA1WXxczjrjLyb76GHb49KZF1EWYZgVTuO04NZQtOdzFSMvUHxhsD0iTJ6bAhsneK2lkkw9CIDeMM8b%2FFDPDc9"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-type: application/json
cf-ray: 85672f2f1b7c1c44-FRA
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H2 200 tracker
top-fwz1.mail.ru/ 43 B
1 KB 47ms
46ms Image
image/gif 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/tracker?_=0.654278106163354;id=3016302;u=https%3A//csgowfire.ru/;st=1708101119270;title=CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5;s=1600*1200;vp=1600*1200;touch=0;hds=1;sid=463a80067ae1ae75;ver=60.4.0;tz=-60%2FEurope%2FBerlin;nt=0/0/1708101118049/////428/429/429/429/563/494/563/789/790/791/1221/1296/1299/4359/4359/4360;ct=1396/1399/1399/1406;gl=u;ni=10//4g/0/0/;detect=0;lvid=1708101119448%3A1708101122409%3A2%3A28675c47a60d3b6fe70d9ebf2d5e7a40;opts=jst-ym;visible=true;js=13;e=RT/load;et=1708101122409

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 79ms
79ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 16 Feb 2024 16:32:02 GMT

GET
H2 200 metrika_match.html Show response
mc.yandex.com/metrika/ Frame 98EE 2 KB
893 B 116ms
116ms Document
text/html 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

482625f9d55feac9a3187b21e5a8ac098bdfaa328a094f7b4dd2d24ba59056e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://yastatic.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 862
content-type: text/html
date: Fri, 16 Feb 2024 16:32:02 GMT
etag: "65cf573e-35e"
expires: Fri, 16 Feb 2024 17:32:02 GMT
last-modified: Fri, 16 Feb 2024 12:38:22 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H2 200 37412095 Show response
mc.yandex.com/watch/ Frame A7AE 459 B
495 B 56ms
54ms Fetch
application/json 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/37412095?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&site-info=%7B%22b%22%3A%22%22%2C%22browser%22%3A%22chrome%22%2C%22extensions%22%3A%22%22%2C%22fresh%22%3A%220%22%2C%22fromCancel%22%3A%22false%22%2C%22fromGoogle%22%3A%22false%22%2C%22infected%22%3A%22%22%2C%22loyal%22%3A%220%22%2C%22old%22%3A%22actual%22%2C%22os%22%3A%22windows%22%2C%22p%22%3A%22%22%2C%22sbscrb%22%3A%22%22%2C%22slow%22%3A%22%22%2C%22winxp%22%3A%22false%22%7D&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Advwfxy7fhrjc20probge5wgr%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1598500665904%3Ahid%3A320285409%3Aphid%3A822589521%3Az%3A60%3Ai%3A20240216173202%3Aet%3A1708101123%3Ac%3A1%3Arn%3A888114005%3Arqn%3A1%3Au%3A1708101122585866858%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Ads%3A0%2C73%2C36%2C4%2C0%2C0%2C%2C16%2C0%2C130%2C130%2C0%2C130%3Aco%3A0%3Acpf%3A1%3Ans%3A1708101120068%3Arqnl%3A1%3Ast%3A1708101123%3At%3A&t=gdpr(6)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

a58863540d62c385370a5758703b6a5ae6339e417ffa79b746d6974182f16df2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 16-Feb-2024 16:32:02 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 459
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:02 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8016 13 KB
5 KB 20ms
13ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 7649
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 14:24:33 GMT
expires: Sat, 15 Feb 2025 14:24:33 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6A69 829 B
556 B 20ms
15ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9676ba6b444bc3e6bbdd5ded9181bc4f569471e9713722a773a93d94abfac5f9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-E7gK5a8mclcsCOhCki15og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-E7gK5a8mclcsCOhCki15og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 16 Feb 2024 16:32:02 GMT
expires: Fri, 16 Feb 2024 16:32:02 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6A69 0
0 37ms
37ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240214&jk=3931450569834711&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

GET
H3 200 Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8016 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ke811GU8D9oP10uMu54EDqWuI5DGCOjC6vNIGcZJ2dY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29ef35d4653c0fda0fd74b8cbb9e040ea5ae2390c608e8c2eaf34819c649d9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 13:57:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9280
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15261
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Feb 2025 13:57:22 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8016 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7ZckXQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:02 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 39385800
mc.yandex.com/webvisor/ 43 B
0 63ms
55ms Fetch
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/39385800?wv-part=1&wv-type=7&wmode=0&wv-hit=822589521&page-url=https%3A%2F%2Fcsgowfire.ru%2F&rn=316723887&browser-info=we%3A1%3Aet%3A1708101123%3Aw%3A1600x1200%3Av%3A1241%3Az%3A60%3Ai%3A20240216173202%3Au%3A1708101120991997061%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Ast%3A1708101123&t=gdpr(14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:02 GMT
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:02 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44B9 0
23 B 39ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4354822595506&version=m202401290101&ct=77&x=1&cor=8290205236407341000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9C3E 0
23 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6531709353610&version=m202401290101&ct=76&x=1&cor=10555165476935340000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 57D8 0
23 B 38ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=3653557350170&version=m202401290101&ct=76&x=1&cor=1953100035993765600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 443C 0
23 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6521390526716&version=m202401290101&ct=76&x=1&cor=5466578710995754000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1418 0
23 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4761453926852&version=m202401290101&ct=77&x=1&cor=3736979346438161000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2961 0
23 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7982058699900&version=m202401290101&ct=77&x=1&cor=3207431186591130600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFA6 0
23 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2679889179326&version=m202401290101&ct=77&x=1&cor=768214845007660000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 40ms
40ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240214&jk=3931450569834711&bg=!uLulu_TNAAZN4L4YbeA7ADQBe5WfOKcy56SOleIlevNrIO7IaHt53UEnaZi1tZOKBcxFUdMvLKVvzmVGmnaXfg2iIZZKAgAAADlSAAAAAmgBB5kCtVHcSFJ5Ys86s5yAfti4n6t_UWyj2bkBKyA4WjWiEmXHPBb_2Fg4vD8DITses8NBvrnNQzkqowsCB73rXi5ApP5sxWHVpf_GSth7BB3SWrM-pA1c4lypjudPA6yIOCPUersxHG5UxPwRudcvI7X_4hsEiD-xdusr7Jw1UI3K24UVK2qdsipGfDtpXxTZQDPCPKgmWL02z681h1LOrA24ngA60pTgsjYTr8k1u8n0ROSEw-a7QI6mhZLihw3mVSPL4EmIsud9fMsn5dD3L_GQtKbYQc1uGm8YZEOnwmhR3mks23BKZzIqfruQZZXy39KbyEZ75mpRgey3j_m1JKwRLXx0trhmDSHMpPHCkh03Ttx2J-7qxUKDYxmT9iS-fkUnNPx_gVRYDw6lyzth8L2jYmjtR6xaCHcoI5vKT92pfxHdkVb17zygD16BIqX4DFQ5rW4pr2bd0JpMZADxCsSbQq1LRg5ykpEfZvs2b2jzCjeSmQtZBbN-2ljak0TSoq3Xqoaif8VuDKcsvbuN9_Kx0VM8pK3uVbB7Bwg9Z9OkfcthWJ1VefCnWiB5RjH3QF0RjiPjXtPBJu9h9ZaRC2BqDwVFmEMbGFIuQXv6RnMD_kLv_hJqw_7KtzIyPV3F4quJtGbQ7fpZRF17zYWCOI77qW1BZADiVozUVLer4mtuLnMX1cf90L2T68KjOX9xfOzX32lL6GCW0oDHsyLe6hec87iEWQ-ztfl_aK-_493PZD-4aHF8QX4A0TRHeAkxyG21nlFg9Np1c5RoQDSCNq7xAIUu8XZS-aW3mWPmvPCKionGq25XIZDrUjJCZt27r0PDoPNQwM5p3_SUoKdXwEVcPo3ThrifffI5JZRCPY5OcFTjI6y7mvYAwLP2BmPq9Ck2ZHKSu2enGmXlg29k20wLe4BMwe0Dmg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D536 0
24 B 38ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7164366584497&version=m202401290101&ct=76&x=1&cor=18355799182143474000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7B44 0
24 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1604269243120&version=m202401290101&ct=76&x=1&cor=8376042128687570000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 39385800
mc.yandex.com/webvisor/ 43 B
0 56ms
56ms Fetch
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/39385800?wv-part=2&wv-type=7&wmode=0&wv-hit=822589521&page-url=https%3A%2F%2Fcsgowfire.ru%2F&rn=50686888&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1708101124%3Aw%3A1600x1200%3Av%3A1241%3Az%3A60%3Ai%3A20240216173204%3Au%3A1708101120991997061%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Ast%3A1708101124&t=gdpr(14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://csgowfire.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:04 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:04 GMT
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:04 GMT

GET
H2 200 /
kraken.rambler.ru/cnt/v2/ 43 B
596 B 77ms
76ms Image
image/gif 81.19.89.16
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kraken.rambler.ru/cnt/v2/?event_type=tech&event_name=ping&project_id=5753332&session_id=19005556_1708101119519&session_number=1&session_event_number=2&version=3.15.7&counter_type=web&experiment=%5B%5B%22exp_ws%22%2C%22no%22%5D%5D&top100_id=t1.5753332.1891670330.1708101119518&adtech_uid=410d9986-9d1a-4221-ba7f-902ad7ff5231&adtech_uid_scope=csgowfire.ru&fingerprint=pA8AAENKs1cCoPNZAT7WYgA%3D&fingerprint_ip=pA8AAENKs1fAETUZARAZYwA%3D&url=https%3A%2F%2Fcsgowfire.ru%2F&request_id=1708101119.518-1671281840&event_id=664511245209720&meta=%7B%22activity%22%3A%7B%7D%2C%22scroll%22%3A%7B%22min%22%3A0%2C%22max%22%3A1200%2C%22current%22%3A0%7D%2C%22doscroll%22%3A%7B%22min%22%3A0%2C%22max%22%3A32%2C%22current%22%3A0%7D%2C%22num%22%3A1%2C%22duration%22%3A5%7D&rn=768330499
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.16 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:04 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
x-srv: 0kraken-prod0003.ad.rambler.tech
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif, image/gif
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 dc_oe=ChMIx9Llw6SwhAMVGid7Bx09awpcEAEYACDinrJk;dc_eps=AHas8cD4d7xbWrpMUbwMKycfFgSLiQnQzUT2tyUjjLfbxMgywsudZXxY0kIe-L0sVF1udc6rqvjGouT64BkGfWyAKyU;met=1;&timestamp=1708101131071;eid1=871060;ecn1=1;e...
ade.googlesyndication.com/ddm/activity/ Frame F05C 42 B
401 B 105ms
40ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIx9Llw6SwhAMVGid7Bx09awpcEAEYACDinrJk;dc_eps=AHas8cD4d7xbWrpMUbwMKycfFgSLiQnQzUT2tyUjjLfbxMgywsudZXxY0kIe-L0sVF1udc6rqvjGouT64BkGfWyAKyU;met=1;&timestamp=1708101131071;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIs72nxKSwhAMV_5b9Bx0wkwzIEAAYACDYyohgQhMIxtLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCQH4PbRhzK0bAZCPB9cYCLM2R1aJelcya5OAQg8EX67phnaB-dOFpwas5WR5CtECsSBVApAEqc2hphz9g1M9Q;met=1;&timestamp=170810...
ade.googlesyndication.com/ddm/activity/ Frame D536 42 B
107 B 40ms
40ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIs72nxKSwhAMV_5b9Bx0wkwzIEAAYACDYyohgQhMIxtLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCQH4PbRhzK0bAZCPB9cYCLM2R1aJelcya5OAQg8EX67phnaB-dOFpwas5WR5CtECsSBVApAEqc2hphz9g1M9Q;met=1;&timestamp=1708101132400;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI2YajxKSwhAMVXp79Bx0z-A3vEAAYACDYyohgQhMIxdLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCCTAEJDhS8ogeBMXywwj46vxA-2bSDnfmibIlRl1MzqusVc6Y5JiXBqYKDloQfp9JAmkuMa_X2sR-2MuPVpv4;met=1;&timestamp=170810...
ade.googlesyndication.com/ddm/activity/ Frame 7B44 42 B
107 B 41ms
41ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI2YajxKSwhAMVXp79Bx0z-A3vEAAYACDYyohgQhMIxdLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCCTAEJDhS8ogeBMXywwj46vxA-2bSDnfmibIlRl1MzqusVc6Y5JiXBqYKDloQfp9JAmkuMa_X2sR-2MuPVpv4;met=1;&timestamp=1708101132407;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
kraken.rambler.ru/cnt/v2/ 43 B
596 B 79ms
79ms Image
image/gif 81.19.89.16
RAMBLER-TELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kraken.rambler.ru/cnt/v2/?event_type=tech&event_name=ping&project_id=5753332&session_id=19005556_1708101119519&session_number=1&session_event_number=3&version=3.15.7&counter_type=web&experiment=%5B%5B%22exp_ws%22%2C%22no%22%5D%5D&top100_id=t1.5753332.1891670330.1708101119518&adtech_uid=410d9986-9d1a-4221-ba7f-902ad7ff5231&adtech_uid_scope=csgowfire.ru&fingerprint=pA8AAENKs1cCoPNZAT7WYgA%3D&fingerprint_ip=pA8AAENKs1fAETUZARAZYwA%3D&url=https%3A%2F%2Fcsgowfire.ru%2F&request_id=1708101119.518-1671281840&event_id=471111345221048&meta=%7B%22activity%22%3A%7B%7D%2C%22scroll%22%3A%7B%22min%22%3A0%2C%22max%22%3A1200%2C%22current%22%3A0%7D%2C%22doscroll%22%3A%7B%22min%22%3A0%2C%22max%22%3A32%2C%22current%22%3A0%7D%2C%22num%22%3A2%2C%22duration%22%3A10%7D&rn=898897411
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.19.89.16 , Russian Federation, ASN24638 (RAMBLER-TELECOM-AS, RU),
Reverse DNS: kraken.rambler.ru
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:14 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
x-srv: 0kraken-prod0003.ad.rambler.tech
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif, image/gif
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

POST
H2 200 1
mc.yandex.com/watch/39385800/ 43 B
163 B 56ms
56ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/39385800/1?page-url=https%3A%2F%2Fcsgowfire.ru%2F&charset=utf-8&hittoken=1708101119_83b8c9b173d36ef010c43ce406052f401b4b8880b1cc720ed333098bec0036a3&browser-info=nb%3A1%3Acl%3A317%3Aar%3A1%3Avf%3Ad7x9vdjtlsnebtmoc6xy5om3%3Afu%3A0%3Aen%3Awindows-1251%3Ala%3Aen-US%3Av%3A1241%3Acn%3A1%3Adp%3A1%3Als%3A1606409500265%3Ahid%3A822589521%3Az%3A60%3Ai%3A20240216173214%3Aet%3A1708101135%3Ac%3A1%3Arn%3A230034698%3Arqn%3A3%3Au%3A1708101120991997061%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C4359%2C4359%2C1%2C%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708101118049%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101135&t=gdpr(14)mc(p-2-h-1)clc(0-0-0)rqnt(3)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22ct.e%22%3A%22ns%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:14 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:14 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://csgowfire.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:14 GMT

POST
H2 200 1
mc.yandex.com/watch/37412095/ Frame A7AE 43 B
146 B 51ms
50ms Ping
image/gif 2a02:6b8::1:119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/37412095/1?page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&charset=utf-8&hittoken=1708101122_94597323f029d0c10ab8342065a6641597fff9229ec92821f1ff97cffe4fc738&browser-info=nb%3A1%3Acl%3A254%3Aar%3A1%3Avf%3Advwfxy7fhrjc20probge5wgr%3Afu%3A1%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1241%3Acn%3A2%3Adp%3A1%3Als%3A1598500665904%3Ahid%3A320285409%3Aphid%3A822589521%3Az%3A60%3Ai%3A20240216173217%3Aet%3A1708101137%3Ac%3A1%3Arn%3A758181457%3Arqn%3A2%3Au%3A1708101122585866858%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1708101120068%3Ahsa%3A1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1708101137&t=gdpr(6)clc(0-0-0)rqnt(2)aw(1)rcm(1)cdl(na)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22ct.e%22%3A%22ns%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:17 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16-Feb-2024 16:32:17 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 16-Feb-2024 16:32:17 GMT

GET
H2 200 tracker
top-fwz1.mail.ru/ 43 B
1 KB 47ms
47ms Image
image/gif 95.163.52.67
VK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/tracker?_=0.9388389343842174;id=3016302;u=https%3A//csgowfire.ru/;st=1708101119270;title=CS%3AGO%2C%20CrossFire%2C%20WarFace!%20%D0%A7%D0%B8%D1%82%20-%20%D0%BA%D0%BE%D0%B4%D1%8B%20%D0%B8%20%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%D0%B5%20%D0%B4%D1%80%D1%83%D0%B3%D0%BE%D0%B5;s=1600*1200;vp=1600*1200;touch=0;hds=1;sid=463a80067ae1ae75;ver=60.4.0;tz=-60%2FEurope%2FBerlin;ct=1396/1399/1399/1406;gl=u;ni=10//4g/0/0/;detect=0;lvid=1708101119448%3A1708101137410%3A3%3A28675c47a60d3b6fe70d9ebf2d5e7a40;opts=jst-ym;visible=true;js=13;e=PVT/15

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

95.163.52.67 , Russian Federation, ASN47764 (VK-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://csgowfire.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Fri, 16 Feb 2024 16:32:17 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
accept-ch-lifetime: 86400
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: *

GET
H3 200 dc_oe=ChMIx9Llw6SwhAMVGid7Bx09awpcEAEYACDinrJk;dc_eps=AHas8cD4d7xbWrpMUbwMKycfFgSLiQnQzUT2tyUjjLfbxMgywsudZXxY0kIe-L0sVF1udc6rqvjGouT64BkGfWyAKyU;met=1;&timestamp=1708101141071;eid1=2;ecn1=0;etm1=10;
ade.googlesyndication.com/ddm/activity/ Frame F05C 42 B
63 B 41ms
40ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIs72nxKSwhAMV_5b9Bx0wkwzIEAAYACDYyohgQhMIxtLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCQH4PbRhzK0bAZCPB9cYCLM2R1aJelcya5OAQg8EX67phnaB-dOFpwas5WR5CtECsSBVApAEqc2hphz9g1M9Q;met=1;&timestamp=170810...
ade.googlesyndication.com/ddm/activity/ Frame D536 42 B
63 B 41ms
41ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 16 Feb 2024 16:32:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI2YajxKSwhAMVXp79Bx0z-A3vEAAYACDYyohgQhMIxdLlw6SwhAMVGid7Bx09awpc;dc_eps=AHas8cCCTAEJDhS8ogeBMXywwj46vxA-2bSDnfmibIlRl1MzqusVc6Y5JiXBqYKDloQfp9JAmkuMa_X2sR-2MuPVpv4;met=1;&timestamp=170810...
ade.googlesyndication.com/ddm/activity/ Frame 7B44 42 B
63 B 39ms
38ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS